Learning to Defend by Learning to Attack

Abstract

Adversarial training provides a principled approach for training robust neural networks. From an optimization perspective, adversarial training is essentially solving a bilevel optimization problem. The leader problem is trying to learn a robust classifier, while the follower problem is trying to generate adversarial samples. Unfortunately, such a bilevel problem is difficult to solve due to its highly complicated structure. This work proposes a new adversarial training method based on a generic learning-to-learn (L2L) framework. Specifically, instead of applying existing hand-designed algorithms for the inner problem, we learn an optimizer, which is parametrized as a convolutional neural network. At the same time, a robust classifier is learned to defense the adversarial attack generated by the learned optimizer. Experiments over CIFAR-10 and CIFAR-100 datasets demonstrate that L2L outperforms existing adversarial training methods in both classification accuracy and computational efficiency. Moreover, our L2L framework can be extended to generative adversarial imitation learning and stabilize the training.

References in corpus (17)

• Adam: A Method for Stochastic Optimization
• Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
• mixup: Beyond Empirical Risk Minimization
• GANs Trained by a Two Time-Scale Update Rule Converge to a Local Nash Equilibrium
• Spectral Normalization for Generative Adversarial Networks
• Trust Region Policy Optimization
• Wide Residual Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• On Evaluating Adversarial Robustness
• Generative Adversarial Imitation Learning
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Generating Adversarial Examples with Adversarial Networks
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• A Direct Approach to Robust Deep Learning Using Adversarial Networks
• Learning from Conditional Distributions via Dual Embeddings

Cited by in corpus (8)

• Learning to Optimize: A Primer and A Benchmark
• Adversarial Distributional Training for Robust Deep Learning
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• Bag of Tricks for Adversarial Training
• Calibrated Language Model Fine-Tuning for In- and Out-of-Distribution Data
• Improved Adversarial Training via Learned Optimizer
• Smoothed Inference for Adversarially-Trained Models
• Colored Noise Injection for Training Adversarially Robust Neural Networks