Effects of Loss Functions And Target Representations on Adversarial Robustness
arXiv:1812.00181
Abstract
Understanding and evaluating the robustness of neural networks under adversarial settings is a subject of growing interest. Attacks proposed in the literature usually work with models trained to minimize cross-entropy loss and output softmax probabilities. In this work, we present interesting experimental results that suggest the importance of considering other loss functions and target representations, specifically, (1) training on mean-squared error and (2) representing targets as codewords generated from a random codebook. We evaluate the robustness of neural networks that implement these proposed modifications using existing attacks, showing an increase in accuracy against untargeted attacks of up to 98.7\% and a decrease of targeted attack success rates of up to 99.8\%. Our model demonstrates more robustness compared to its conventional counterpart even against attacks that are tailored to our modifications. Furthermore, we find that the parameters of our modified model have significantly smaller Lipschitz bounds, an important measure correlated with a model's sensitivity to adversarial perturbations.
arXiv comment8 pages, 4 figures. Accepted at MLSys 2020 First Workshop on Secure and Resilient Autonomy
References in corpus (22)
- Adam: A Method for Stochastic Optimization
- Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
- Playing Atari with Deep Reinforcement Learning
- WaveNet: A Generative Model for Raw Audio
- Trust Region Policy Optimization
- Ensemble Adversarial Training: Attacks and Defenses
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Character-Aware Neural Language Models
- Countering Adversarial Images using Input Transformations
- Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
- Certifying Some Distributional Robustness with Principled Adversarial Training
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Adversarial Examples: Attacks and Defenses for Deep Learning
- Stochastic Activation Pruning for Robust Adversarial Defense
- Mitigating Adversarial Effects Through Randomization
- Robust Audio Adversarial Example for a Physical Attack
- The Singular Values of Convolutional Layers
- Characterizing Audio Adversarial Examples Using Temporal Dependency
- Exploring the Space of Black-box Attacks on Deep Neural Networks
- Reinforcing Adversarial Robustness using Model Confidence Induced by Adversarial Training