On Norm-Agnostic Robustness of Adversarial Training

Abstract

Adversarial examples are carefully perturbed in-puts for fooling machine learning models. A well-acknowledged defense method against such examples is adversarial training, where adversarial examples are injected into training data to increase robustness. In this paper, we propose a new attack to unveil an undesired property of the state-of-the-art adversarial training, that is it fails to obtain robustness against perturbations in ${\ell }_2$ and ${\ell }_{\infty }$ norms simultaneously. We discuss a possible solution to this issue and its limitations as well.

arXiv comment4 pages, 2 figures, presented at the ICML 2019 Workshop on Uncertainty and Robustness in Deep Learning. arXiv admin note: text overlap with arXiv:1809.03113

References in corpus (6)

• Wide Residual Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Virtual Adversarial Training: A Regularization Method for Supervised and Semi-Supervised Learning
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Unrestricted Adversarial Examples

Cited by in corpus (1)

• Adversarial Robustness of Stabilized NeuralODEs Might be from Obfuscated Gradients