Adversarial Training with Voronoi Constraints

Abstract

Adversarial examples are a pervasive phenomenon of machine learning models where seemingly imperceptible perturbations to the input lead to misclassifications for otherwise statistically accurate models. We propose a geometric framework, drawing on tools from the manifold reconstruction literature, to analyze the high-dimensional geometry of adversarial examples. In particular, we highlight the importance of codimension: for low-dimensional data manifolds embedded in high-dimensional space there are many directions off the manifold in which an adversary could construct adversarial examples. Adversarial examples are a natural consequence of learning a decision boundary that classifies the low-dimensional data manifold well, but classifies points near the manifold incorrectly. Using our geometric framework we prove that adversarial training is sample inefficient, and show sufficient sampling conditions under which nearest neighbor classifiers and ball-based adversarial training are robust. Finally we introduce adversarial training with Voronoi constraints, which replaces the norm ball constraint with the Voronoi cell for each point in the training set. We show that adversarial training with Voronoi constraints produces robust models which significantly improve over the state-of-the-art on MNIST and are competitive on CIFAR-10.

arXiv admin note: substantial text overlap with arXiv:1811.00525

References in corpus (4)

• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library

Cited by in corpus (7)

• Voronoi cell analysis: The shapes of particle systems
• Defending Against Adversarial Examples with K-Nearest Neighbor
• RobOT: Robustness-Oriented Testing for Deep Learning Systems
• Smoothed Inference for Adversarially-Trained Models
• Colored Noise Injection for Training Adversarially Robust Neural Networks
• Defending SVMs against Poisoning Attacks: the Hardness and DBSCAN Approach
• Adaptive versus Standard Descent Methods and Robustness Against Adversarial Examples