Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles
arXiv:1811.09300
Abstract
While deep learning has led to remarkable results on a number of challenging problems, researchers have discovered a vulnerability of neural networks in adversarial settings, where small but carefully chosen perturbations to the input can make the models produce extremely inaccurate outputs. This makes these models particularly unsuitable for safety-critical application domains (e.g. self-driving cars) where robustness is extremely important. Recent work has shown that augmenting training with adversarially generated data provides some degree of robustness against test-time attacks. In this paper we investigate how this approach scales as we increase the computational budget given to the defender. We show that increasing the number of parameters in adversarially-trained models increases their robustness, and in particular that ensembling smaller models while adversarially training the entire ensemble as a single model is a more efficient way of spending said budget than simply using a larger single model. Crucially, we show that it is the adversarial training of the ensemble, rather than the ensembling of adversarially trained models, which provides robustness.
arXiv comment12 pages
References in corpus (20)
- Adam: A Method for Stochastic Optimization
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Popular Ensemble Methods: An Empirical Study
- Ensemble Adversarial Training: Attacks and Defenses
- Wide Residual Networks
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- Simple and Scalable Predictive Uncertainty Estimation using Deep Ensembles
- Improved Image Captioning via Policy Gradient optimization of SPIDEr
- Deep Exploration via Bootstrapped DQN
- Countering Adversarial Images using Input Transformations
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- Adversarial Examples for Evaluating Reading Comprehension Systems
- Defensive Distillation is Not Robust to Adversarial Examples
- Adversarial Examples: Attacks and Defenses for Deep Learning
- Mitigating Adversarial Effects Through Randomization
- Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
- Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser