Theoretically Principled Trade-off between Robustness and Accuracy

Abstract

We identify a trade-off between robustness and accuracy that serves as a guiding principle in the design of defenses against adversarial examples. Although this problem has been widely studied empirically, much remains unknown concerning the theory underlying this trade-off. In this work, we decompose the prediction error for adversarial examples (robust error) as the sum of the natural (classification) error and boundary error, and provide a differentiable upper bound using the theory of classification-calibrated loss, which is shown to be the tightest possible upper bound uniform over all probability distributions and measurable predictors. Inspired by our theoretical analysis, we also design a new defense method, TRADES, to trade adversarial robustness off against accuracy. Our proposed algorithm performs well experimentally in real-world datasets. The methodology is the foundation of our entry to the NeurIPS 2018 Adversarial Vision Challenge in which we won the 1st place out of ~2,000 submissions, surpassing the runner-up approach by $11.41\%$ in terms of mean ${\ell }_2$ perturbation distance.

Appeared in ICML 2019; the winning methodology of the NeurIPS 2018 Adversarial Vision Challenge

References in corpus (24)

• Intriguing properties of neural networks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Learning with a Strong Adversary
• Stochastic Activation Pruning for Robust Adversarial Defense
• Semidefinite relaxations for certifying robustness to adversarial examples
• Are Labels Required for Improving Adversarial Robustness?
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial examples from computational constraints
• Rademacher Complexity for Adversarially Robust Generalization
• Feature Denoising for Improving Adversarial Robustness
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Unrestricted Adversarial Examples
• Unlabeled Data Improves Adversarial Robustness
• Cascade Adversarial Machine Learning Regularized with a Unified Embedding
• Stackelberg GAN: Towards Provable Minimax Equilibrium via Multi-Generator Architectures
• Adversarial Examples from Cryptographic Pseudo-Random Generators
• Multiclass Classification Calibration Functions
• Deep Neural Networks with Multi-Branch Architectures Are Less Non-Convex

Cited by in corpus (335)

• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty
• Large-Scale Adversarial Training for Vision-and-Language Representation Learning
• Adversarial Weight Perturbation Helps Robust Generalization
• Are Labels Required for Improving Adversarial Robustness?
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• Adversarial Training Can Hurt Generalization
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• Non-convex Min-Max Optimization: Applications, Challenges, and Recent Theoretical Advances
• RobustBench: a standardized adversarial robustness benchmark
• Do Adversarially Robust ImageNet Models Transfer Better?
• Fixing Data Augmentation to Improve Adversarial Robustness
• Torchattacks: A PyTorch Repository for Adversarial Attacks
• A Review of Adversarial Attack and Defense for Classification Methods
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Smooth Adversarial Training
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Unsolved Problems in ML Safety
• Self-Adaptive Training: beyond Empirical Risk Minimization
• The Pitfalls of Simplicity Bias in Neural Networks
• Functional Adversarial Attacks
• Adversarial Training against Location-Optimized Adversarial Patches
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Adversarial Self-Supervised Contrastive Learning
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• A Closer Look at Accuracy vs. Robustness
• DeepRobust: A PyTorch Library for Adversarial Attacks and Defenses
• Testing Robustness Against Unforeseen Adversaries
• Towards quantum enhanced adversarial robustness in machine learning
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• Unlabeled Data Improves Adversarial Robustness
• Boosting Adversarial Training with Hypersphere Embedding
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Controlling Neural Level Sets
• Security and Privacy Issues in Deep Learning
• Towards Evaluating the Robustness of Deep Diagnostic Models by Adversarial Attack
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Contrastive Learning with Adversarial Examples
• Robust Local Features for Improving the Generalization of Adversarial Training
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• RobustART: Benchmarking Robustness on Architecture Design and Training Techniques
• Learning from others' mistakes: Avoiding dataset biases without modeling them
• Adversarial Examples Improve Image Recognition
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• Unlearnable Examples: Making Personal Data Unexploitable
• Robust Reinforcement Learning on State Observations with Learned Optimal Adversary
• Overfitting in adversarially robust deep learning
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• Understanding and Improving Fast Adversarial Training
• Adversarial Attacks and Defenses for Semantic Communication in Vehicular Metaverses
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks
• Semantic-Aware Adversarial Training for Reliable Deep Hashing Retrieval
• Advancing diagnostic performance and clinical usability of neural networks via adversarial training and dual batch normalization
• Adversarially Robust Few-Shot Learning: A Meta-Learning Approach
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations
• Adversarially Robust Neural Architectures
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Do Wider Neural Networks Really Help Adversarial Robustness?
• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• MaxUp: A Simple Way to Improve Generalization of Neural Network Training
• Adversarial Distributional Training for Robust Deep Learning
• Natural Language Adversarial Defense through Synonym Encoding
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Understanding Real-world Threats to Deep Learning Models in Android Apps
• Geometry-aware Instance-reweighted Adversarial Training
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• HYDRA: Pruning Adversarially Robust Neural Networks
• How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?
• The Curious Case of Adversarially Robust Models: More Data Can Help, Double Descend, or Hurt Generalization
• Globally-Robust Neural Networks
• Unleashing the Power of Contrastive Self-Supervised Visual Models via Contrast-Regularized Fine-Tuning
• Learning to Defend by Learning to Attack
• A Closer Look at the Robustness of Vision-and-Language Pre-trained Models
• Adversarial Robustness via Fisher-Rao Regularization
• Improved Sample Complexities for Deep Networks and Robust Classification via an All-Layer Margin
• Robustness of Bayesian Neural Networks to Gradient-Based Attacks
• Bridging Adversarial Robustness and Gradient Interpretability
• Enhancing the Transferability of Adversarial Attacks through Variance Tuning
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Towards Understanding Fast Adversarial Training
• To be Robust or to be Fair: Towards Fairness in Adversarial Training
• Probabilistic Deep Learning to Quantify Uncertainty in Air Quality Forecasting
• Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Frame
• Recent advances in deep learning theory
• Towards Compact and Robust Deep Neural Networks
• Towards Feature Space Adversarial Attack
• Constrained Learning with Non-Convex Losses
• Boundary thickness and robustness in learning models
• Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks
• Adversarial Neural Pruning with Latent Vulnerability Suppression
• Reliable Adversarial Distillation with Unreliable Teachers
• Robustness May Be at Odds with Fairness: An Empirical Study on Class-wise Accuracy
• Quantifying the Preferential Direction of the Model Gradient in Adversarial Training With Projected Gradient Descent
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Probabilistic Margins for Instance Reweighting in Adversarial Training
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Unlearn Dataset Bias in Natural Language Inference by Fitting the Residual
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuning
• A Single-Loop Smoothed Gradient Descent-Ascent Algorithm for Nonconvex-Concave Min-Max Problems
• SAT: Improving Adversarial Training via Curriculum-Based Loss Smoothing
• InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle
• Breaking certified defenses: Semantic adversarial examples with spoofed robustness certificates
• Intriguing properties of adversarial training at scale
• Deep Reinforcement Learning with Robust and Smooth Policy
• ResNets Ensemble via the Feynman-Kac Formalism to Improve Natural and Robust Accuracies
• Towards Understanding the Adversarial Vulnerability of Skeleton-based Action Recognition
• Exploring Memorization in Adversarial Training
• Vulnerability-Aware Poisoning Mechanism for Online RL with Unknown Dynamics
• Achieving Adversarial Robustness via Sparsity
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Understanding and Improving Robustness of Vision Transformers through Patch-based Negative Augmentation
• Two Souls in an Adversarial Image: Towards Universal Adversarial Example Detection using Multi-view Inconsistency
• Random Hypervolume Scalarizations for Provable Multi-Objective Black Box Optimization
• Multitask Learning Strengthens Adversarial Robustness
• Online Adversarial Purification based on Self-Supervision
• Learnable Boundary Guided Adversarial Training
• Adversarial Image Color Transformations in Explicit Color Filter Space
• Bag of Tricks for Adversarial Training
• EllSeg-Gen, towards Domain Generalization for head-mounted eyetracking
• CIFS: Improving Adversarial Robustness of CNNs via Channel-wise Importance-based Feature Selection
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• LTD: Low Temperature Distillation for Gradient Masking-free Adversarial Training
• Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Them
• Calibrated Surrogate Losses for Adversarially Robust Classification
• Efficient Adversarial Training with Transferable Adversarial Examples
• Manifold Regularization for Locally Stable Deep Neural Networks
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• Neural Architecture Dilation for Adversarial Robustness
• Adversarial Robustness under Long-Tailed Distribution
• Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• Increasing-Margin Adversarial (IMA) Training to Improve Adversarial Robustness of Neural Networks
• Decision-based Universal Adversarial Attack
• Attribution-driven Causal Analysis for Detection of Adversarial Examples
• Optimization's Neglected Normative Commitments
• Learning Adversarially Robust Representations via Worst-Case Mutual Information Maximization
• Jacobian Adversarially Regularized Networks for Robustness
• Adversarial Defense by Suppressing High-frequency Components
• Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attacks
• Adversarial jamming attacks and defense strategies via adaptive deep reinforcement learning
• Second-Order Provable Defenses against Adversarial Attacks
• DAmageNet: A Universal Adversarial Dataset
• Adversarial Robustness through the Lens of Convolutional Filters
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• Adversarial Artifact Detection in EEG-Based Brain-Computer Interfaces
• Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspective
• LiBRe: A Practical Bayesian Approach to Adversarial Detection
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• Adversarial Attacks and Defenses: An Interpretation Perspective
• RobFR: Benchmarking Adversarial Robustness on Face Recognition
• Why are Saliency Maps Noisy? Cause of and Solution to Noisy Saliency Maps
• HateProof: Are Hateful Meme Detection Systems really Robust?
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Enhancing Adversarial Defense by k-Winners-Take-All
• Sharp Statistical Guarantees for Adversarially Robust Gaussian Classification
• Guided Interpolation for Adversarial Training
• RecRec: Algorithmic Recourse for Recommender Systems
• Automation of Quantum Dot Measurement Analysis via Explainable Machine Learning
• Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learning
• RNAS-CL: Robust Neural Architecture Search by Cross-Layer Knowledge Distillation
• Boosting the Certified Robustness of L-infinity Distance Nets
• BulletTrain: Accelerating Robust Neural Network Training via Boundary Example Mining
• Calibration and Consistency of Adversarial Surrogate Losses
• Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?
• Formalizing Generalization and Robustness of Neural Networks to Weight Perturbations
• CAP-GAN: Towards Adversarial Robustness with Cycle-consistent Attentional Purification
• Self-Adaptive Training: Bridging Supervised and Self-Supervised Learning
• SOAR: Second-Order Adversarial Regularization
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Regularizers for Single-step Adversarial Training
• Adversarial robustness via robust low rank representations
• Adversarially Robust Low Dimensional Representations
• On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks
• A Bayes-Optimal View on Adversarial Examples
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Towards Defending Multiple ${\ell }_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization
• Pyramid Adversarial Training Improves ViT Performance
• Improving Robustness using Generated Data
• Towards Evaluating the Robustness of Neural Networks Learned by Transduction
• Nonconvex-Nonconcave Min-Max Optimization with a Small Maximization Domain
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• Toward Adversarial Robustness via Semi-supervised Robust Training
• Data Quality Matters For Adversarial Training: An Empirical Study
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Fooling Adversarial Training with Inducing Noise
• AccelAT: A Framework for Accelerating the Adversarial Training of Deep Neural Networks through Accuracy Gradient
• Input Hessian Regularization of Neural Networks
• Internal Wasserstein Distance for Adversarial Attack and Defense
• Are Interpretations Fairly Evaluated? A Definition Driven Pipeline for Post-Hoc Interpretability
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• Robustness through Data Augmentation Loss Consistency
• Tiny Adversarial Mulit-Objective Oneshot Neural Architecture Search
• Adversarially Regularized Policy Learning Guided by Trajectory Optimization
• Defending Against Image Corruptions Through Adversarial Augmentations
• Less Is Better: Unweighted Data Subsampling via Influence Function
• Adaptive Feature Alignment for Adversarial Training
• ATRO: Adversarial Training with a Rejection Option
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks
• RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• Improve Adversarial Robustness via Weight Penalization on Classification Layer
• Improving Model Robustness with Latent Distribution Locally and Globally
• Robustness Out of the Box: Compositional Representations Naturally Defend Against Black-Box Patch Attacks
• A Singular Value Perspective on Model Robustness
• LAFEAT: Piercing Through Adversarial Defenses with Latent Features
• Asymptotic Behavior of Adversarial Training in Binary Classification
• Weight-Covariance Alignment for Adversarially Robust Neural Networks
• Improved Adversarial Training via Learned Optimizer
• Architecture Selection via the Trade-off Between Accuracy and Robustness
• Network insensitivity to parameter noise via adversarial regularization
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Understanding the Generalization Benefit of Model Invariance from a Data Perspective
• Adversarial Robustness of Stabilized NeuralODEs Might be from Obfuscated Gradients
• Learning Diverse-Structured Networks for Adversarial Robustness
• Encoding Robustness to Image Style via Adversarial Feature Perturbations
• Benchmarking adversarial attacks and defenses for time-series data
• Robust GANs against Dishonest Adversaries
• On Norm-Agnostic Robustness of Adversarial Training
• Adversarial and Natural Perturbations for General Robustness
• Defending against substitute model black box adversarial attacks with the 01 loss
• Vulnerability Under Adversarial Machine Learning: Bias or Variance?
• Contemplating real-world object classification
• Natural Perturbed Training for General Robustness of Neural Network Classifiers
• Understanding the Error in Evaluating Adversarial Robustness
• On the human-recognizability phenomenon of adversarially trained deep image classifiers
• Smooth Imitation Learning via Smooth Costs and Smooth Policies
• A Frequency Perspective of Adversarial Robustness
• Residual Error: a New Performance Measure for Adversarial Robustness
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• Robust Sensible Adversarial Learning of Deep Neural Networks for Image Classification
• Push Stricter to Decide Better: A Class-Conditional Feature Adaptive Framework for Improving Adversarial Robustness
• Meta-Learning the Search Distribution of Black-Box Random Search Based Adversarial Attacks
• Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations
• Smoothness Analysis of Adversarial Training
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Understanding and Achieving Efficient Robustness with Adversarial Supervised Contrastive Learning
• Beneficial Perturbations Network for Defending Adversarial Examples
• Adversarial Feature Desensitization
• Probably Approximately Correct Constrained Learning
• Towards Deep Learning Models Resistant to Large Perturbations
• Fast Geometric Projections for Local Robustness Certification
• VideoDG: Generalizing Temporal Relations in Videos to Novel Domains
• What it Thinks is Important is Important: Robustness Transfers through Input Gradients
• Smoothed Inference for Adversarially-Trained Models
• Collaborative Sampling in Generative Adversarial Networks
• Building Compact and Robust Deep Neural Networks with Toeplitz Matrices
• Identification of Attack-Specific Signatures in Adversarial Examples
• 10 Security and Privacy Problems in Large Foundation Models
• Multiplicative Reweighting for Robust Neural Network Optimization
• Removing Undesirable Feature Contributions Using Out-of-Distribution Data
• Dynamic Efficient Adversarial Training Guided by Gradient Magnitude
• Lower Bounds on Cross-Entropy Loss in the Presence of Test-time Adversaries
• Robust binary classification with the 01 loss
• Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptation
• Robusta: Robust AutoML for Feature Selection via Reinforcement Learning
• Enhance Diffusion to Improve Robust Generalization
• The Effects of Image Distribution and Task on Adversarial Robustness
• A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
• Towards Evaluating and Training Verifiably Robust Neural Networks
• DP-Net: Dynamic Programming Guided Deep Neural Network Compression
• Towards Precise Observations of Neural Model Robustness in Classification
• Adaptive Adversarial Training Does Not Increase Recourse Costs
• Robust Network Slicing: Multi-Agent Policies, Adversarial Attacks, and Defensive Strategies
• On the transferability of adversarial examples between convex and 01 loss models
• Cross-domain Cross-architecture Black-box Attacks on Fine-tuned Models with Transferred Evolutionary Strategies
• Colored Noise Injection for Training Adversarially Robust Neural Networks
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Robustness from Simple Classifiers
• On ${\ell }_p$-norm Robustness of Ensemble Stumps and Trees
• Domain Invariant Adversarial Learning
• Towards the Memorization Effect of Neural Networks in Adversarial Training
• Blind Adversarial Pruning: Balance Accuracy, Efficiency and Robustness
• Augmenting Model Robustness with Transformation-Invariant Attacks
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Patch-level Neighborhood Interpolation: A General and Effective Graph-based Regularization Strategy
• ImageNet Pre-training also Transfers Non-Robustness
• Enhance CNN Robustness Against Noises for Classification of 12-Lead ECG with Variable Length
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Adversarial Learning with Cost-Sensitive Classes
• Perceptual Deep Neural Networks: Adversarial Robustness through Input Recreation
• Posterior Differential Regularization with f-divergence for Improving Model Robustness
• Adversarial Training with Stochastic Weight Average
• Semantics-Preserving Adversarial Training
• Adversarial Boot Camp: label free certified robustness in one epoch
• Robust Neural Networks inspired by Strong Stability Preserving Runge-Kutta methods
• Adaptive versus Standard Descent Methods and Robustness Against Adversarial Examples
• One Man's Trash is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples
• Feature Losses for Adversarial Robustness
• Graph Interpolating Activation Improves Both Natural and Robust Accuracies in Data-Efficient Deep Learning
• Robust Machine Learning via Privacy/Rate-Distortion Theory
• Shape Defense Against Adversarial Attacks
• An Integrated Approach to Produce Robust Models with High Efficiency
• Adversarial Training: embedding adversarial perturbations into the parameter space of a neural network to build a robust system
• Luring of transferable adversarial perturbations in the black-box paradigm
• Constant Random Perturbations Provide Adversarial Robustness with Minimal Effect on Accuracy
• Adversarial Reinforcement Learning in Dynamic Channel Access and Power Control
• ASK: Adversarial Soft k-Nearest Neighbor Attack and Defense
• Introducing the DOME Activation Functions
• Subspace Adversarial Training
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search
• Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustness
• Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness
• Noisy Feature Mixup
• Towards Optimal Randomized Strategies in Adversarial Example Game
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• Training Efficiency and Robustness in Deep Learning
• Balancing Robustness and Sensitivity using Feature Contrastive Learning
• Robust Regularization with Adversarial Labelling of Perturbed Samples
• Less is More: Feature Selection for Adversarial Robustness with Compressive Counter-Adversarial Attacks
• Identifying Layers Susceptible to Adversarial Attacks
• Neural Network Repair with Reachability Analysis
• Bridged Adversarial Training
• Understanding Adversarial Behavior of DNNs by Disentangling Non-Robust and Robust Components in Performance Metric
• Adversarial Defense via Local Flatness Regularization
• Towards A Conceptually Simple Defensive Approach for Few-shot classifiers Against Adversarial Support Samples
• Extreme Value Preserving Networks
• Self-Gradient Networks
• Adversarial Robustness Across Representation Spaces
• Towards Natural Robustness Against Adversarial Examples
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• Improving the Certified Robustness of Neural Networks via Consistency Regularization
• Sparse Coding Frontend for Robust Neural Networks
• Class-Aware Domain Adaptation for Improving Adversarial Robustness
• Unique properties of adversarially trained linear classifiers on Gaussian data
• Robust Face Verification via Disentangled Representations
• Decoder-free Robustness Disentanglement without (Additional) Supervision
• Towards adversarial robustness with 01 loss neural networks
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses