Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models

Abstract

Neural networks are vulnerable to adversarial attacks -- small visually imperceptible crafted noise which when added to the input drastically changes the output. The most effective method of defending against these adversarial attacks is to use the methodology of adversarial training. We analyze the adversarially trained robust models to study their vulnerability against adversarial attacks at the level of the latent layers. Our analysis reveals that contrary to the input layer which is robust to adversarial attack, the latent layer of these robust models are highly susceptible to adversarial perturbations of small magnitude. Leveraging this information, we introduce a new technique Latent Adversarial Training (LAT) which comprises of fine-tuning the adversarially trained models to ensure the robustness at the feature layers. We also propose Latent Attack (LA), a novel algorithm for construction of adversarial examples. LAT results in minor improvement in test accuracy and leads to a state-of-the-art adversarial accuracy against the universal first-order adversarial PGD attack which is shown for the MNIST, CIFAR-10, CIFAR-100 datasets.

arXiv commentAccepted at IJCAI 2019

References in corpus (5)

• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Provably Minimally-Distorted Adversarial Examples
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• On the Robustness of Interpretability Methods

Cited by in corpus (14)

• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• On the Loss Landscape of Adversarial Training: Identifying Challenges and How to Overcome Them
• Learnable Boundary Guided Adversarial Training
• AdvGAN++ : Harnessing latent layers for adversary generation
• AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Improved Adversarial Training via Learned Optimizer
• Improving Model Robustness with Latent Distribution Locally and Globally
• LAFEAT: Piercing Through Adversarial Defenses with Latent Features
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• White-Box Adversarial Defense via Self-Supervised Data Estimation
• A general framework for defining and optimizing robustness
• Training Provably Robust Models by Polyhedral Envelope Regularization