Towards Understanding Adversarial Examples Systematically: Exploring Data Size, Task and Model Factors

Abstract

Most previous works usually explained adversarial examples from several specific perspectives, lacking relatively integral comprehension about this problem. In this paper, we present a systematic study on adversarial examples from three aspects: the amount of training data, task-dependent and model-specific factors. Particularly, we show that adversarial generalization (i.e. test accuracy on adversarial examples) for standard training requires more data than standard generalization (i.e. test accuracy on clean examples); and uncover the global relationship between generalization and robustness with respect to the data size especially when data is augmented by generative models. This reveals the trade-off correlation between standard generalization and robustness in limited training data regime and their consistency when data size is large enough. Furthermore, we explore how different task-dependent and model-specific factors influence the vulnerability of deep neural networks by extensive empirical analysis. Relevant recommendations on defense against adversarial attacks are provided as well. Our results outline a potential path towards the luminous and systematic understanding of adversarial examples.

References in corpus (13)

• Conditional Generative Adversarial Nets
• Intriguing properties of neural networks
• Conditional Image Synthesis With Auxiliary Classifier GANs
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Robustness May Be at Odds with Accuracy
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Sufficient Conditions for Idealised Models to Have No Adversarial Examples: a Theoretical and Empirical Study with Bayesian Neural Networks
• Defense against Adversarial Attacks Using High-Level Representation Guided Denoiser
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy

Cited by in corpus (8)

• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free
• A Simple Fine-tuning Is All You Need: Towards Robust Deep Learning Via Adversarial Fine-tuning
• Adversarial Feature Augmentation and Normalization for Visual Recognition
• PDA: Progressive Data Augmentation for General Robustness of Deep Neural Networks
• Data-Efficient GAN Training Beyond (Just) Augmentations: A Lottery Ticket Perspective
• Robustness, Privacy, and Generalization of Adversarial Training
• A Useful Taxonomy for Adversarial Robustness of Neural Networks