Transfer of Adversarial Robustness Between Perturbation Types

Abstract

We study the transfer of adversarial robustness of deep neural networks between different perturbation types. While most work on adversarial examples has focused on $L_{\infty }$ and $L_2$-bounded perturbations, these do not capture all types of perturbations available to an adversary. The present work evaluates 32 attacks of 5 different types against models adversarially trained on a 100-class subset of ImageNet. Our empirical results suggest that evaluating on a wide range of perturbation sizes is necessary to understand whether adversarial robustness transfers between perturbation types. We further demonstrate that robustness against one perturbation type may not always imply and may sometimes hurt robustness against other perturbation types. In light of these results, we recommend evaluation of adversarial defenses take place on a diverse range of perturbation types and sizes.

11 pages, 6 figures

References in corpus (8)

• Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Synthesizing Robust Adversarial Examples
• On Evaluating Adversarial Robustness
• Spatially Transformed Adversarial Examples
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Feature Denoising for Improving Adversarial Robustness
• Quantifying Perceptual Distortion of Adversarial Examples

Cited by in corpus (14)

• Adversarial Training and Robustness for Multiple Perturbations
• RobustBench: a standardized adversarial robustness benchmark
• Functional Adversarial Attacks
• Towards quantum enhanced adversarial robustness in machine learning
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Test-Time Training with Self-Supervision for Generalization under Distribution Shifts
• Adversarial Examples in Modern Machine Learning: A Review
• Recent Advances in Adversarial Training for Adversarial Robustness
• On the effectiveness of adversarial training against common corruptions
• Provable robustness against all adversarial $l_p$-perturbations for $p\ge 1$
• Real-time Detection of Practical Universal Adversarial Perturbations
• Robustifying ${\ell }_{\infty }$ Adversarial Training to the Union of Perturbation Models
• A general framework for defining and optimizing robustness
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks