Adversarial Training and Robustness for Multiple Perturbations

Abstract

Defenses against adversarial examples, such as adversarial training, are typically tailored to a single perturbation type (e.g., small ${\ell }_{\infty }$-noise). For other perturbations, these defenses offer no guarantees and, at times, even increase the model's vulnerability. Our aim is to understand the reasons underlying this robustness trade-off, and to train models that are simultaneously robust to multiple perturbation types. We prove that a trade-off in robustness to different types of ${\ell }_p$-bounded and spatial perturbations must exist in a natural and simple statistical setting. We corroborate our formal analysis by demonstrating similar robustness trade-offs on MNIST and CIFAR10. Building upon new multi-perturbation adversarial training schemes, and a novel efficient attack for finding ${\ell }_1$-bounded adversarial examples, we show that no model trained against multiple attacks achieves robustness competitive with that of models trained on each attack individually. In particular, we uncover a pernicious gradient-masking phenomenon on MNIST, which causes adversarial training with first-order ${\ell }_{\infty },{\ell }_1$ and ${\ell }_2$ adversaries to achieve merely $50\%$ accuracy. Our results question the viability and computational scalability of extending adversarial robustness, and adversarial training, to multiple perturbation types.

arXiv commentAccepted at NeurIPS 2019, 23 pages

References in corpus (10)

• Ensemble Adversarial Training: Attacks and Defenses
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Defenses against Adversarial Examples
• Adversarially Robust Generalization Requires More Data
• Robustness and Regularization of Support Vector Machines
• Towards the first adversarially robust neural network model on MNIST
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• Adversarial vulnerability for any classifier
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Transfer of Adversarial Robustness Between Perturbation Types

Cited by in corpus (14)

• Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detection
• RobustBench: a standardized adversarial robustness benchmark
• Secure and Trustworthy Artificial Intelligence-Extended Reality (AI-XR) for Metaverses
• A Framework for Enhancing Deep Neural Networks Against Adversarial Malware
• Contrastive Learning with Adversarial Examples
• Recent Advances in Adversarial Training for Adversarial Robustness
• Mutual Adversarial Training: Learning together is better than going alone
• Consistency Regularization for Certified Robustness of Smoothed Classifiers
• Cyber Vaccine for Deepfake Immunity
• Adversarial Detection and Correction by Matching Prediction Distributions
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Meta Dropout: Learning to Perturb Features for Generalization
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Hypnopaedia-Aware Machine Unlearning via Psychometrics of Artificial Mental Imagery