Rearchitecting Classification Frameworks For Increased Robustness
arXiv:1905.10900
Abstract
While generalizing well over natural inputs, neural networks are vulnerable to adversarial inputs. Existing defenses against adversarial inputs have largely been detached from the real world. These defenses also come at a cost to accuracy. Fortunately, there are invariances of an object that are its salient features; when we break them it will necessarily change the perception of the object. We find that applying invariants to the classification task makes robustness and accuracy feasible together. Two questions follow: how to extract and model these invariances? and how to design a classification paradigm that leverages these invariances to improve the robustness accuracy trade-off? The remainder of the paper discusses solutions to the aformenetioned questions.
References in corpus (34)
- Distilling the Knowledge in a Neural Network
- YOLOv3: An Incremental Improvement
- Intriguing properties of neural networks
- Neural Architecture Search with Reinforcement Learning
- Axiomatic Attribution for Deep Networks
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- DeepXplore: Automated Whitebox Testing of Deep Learning Systems
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- On Evaluating Adversarial Robustness
- Certified Defenses against Adversarial Examples
- Robust Physical-World Attacks on Deep Learning Models
- Generalisation in humans and deep neural networks
- Adversarial Examples Are Not Bugs, They Are Features
- Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
- Certifying Some Distributional Robustness with Principled Adversarial Training
- Invariant Risk Minimization
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
- Distilling a Neural Network Into a Soft Decision Tree
- Learning with a Strong Adversary
- Stochastic Activation Pruning for Robust Adversarial Defense
- Robust Audio Adversarial Example for a Physical Attack
- Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
- Comparing deep neural networks against humans: object recognition when the signal gets weaker
- Adversarial examples from computational constraints
- Physical Adversarial Examples for Object Detectors
- You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
- Excessive Invariance Causes Adversarial Vulnerability
- Generating 3D Adversarial Point Clouds
- Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features
- Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness
- Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers
- Computational Limitations in Robust Classification and Win-Win Results
- Designing Adversarially Resilient Classifiers using Resilient Feature Engineering