Robust Neural Networks using Randomized Adversarial Training

Abstract

This paper tackles the problem of defending a neural network against adversarial attacks crafted with different norms (in particular ${\ell }_{\infty }$ and ${\ell }_2$ bounded adversarial examples). It has been observed that defense mechanisms designed to protect against one type of attacks often offer poor performance against the other. We show that ${\ell }_{\infty }$ defense mechanisms cannot offer good protection against ${\ell }_2$ attacks and vice-versa, and we provide both theoretical and empirical insights on this phenomenon. Then, we discuss various ways of combining existing defense mechanisms in order to train neural networks robust against both types of attacks. Our experiments show that these new defense mechanisms offer better protection when attacked with both norms.

References in corpus (8)

• Wide Residual Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• On Evaluating Adversarial Robustness
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Stochastic Activation Pruning for Robust Adversarial Defense
• Theoretical evidence for adversarial robustness through randomization
• Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attack

Cited by in corpus (9)

• Sensitivity analysis of Wasserstein distributionally robust optimization problems
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Attacking and Defending Machine Learning Applications of Public Cloud
• Towards Rapid and Robust Adversarial Training with One-Step Attacks
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Towards Black-box Attacks on Deep Learning Apps
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Explainable Adversarial Attacks in Deep Neural Networks Using Activation Profiles