Non-Determinism in Neural Networks for Adversarial Robustness

Abstract

Recent breakthroughs in the field of deep learning have led to advancements in a broad spectrum of tasks in computer vision, audio processing, natural language processing and other areas. In most instances where these tasks are deployed in real-world scenarios, the models used in them have been shown to be susceptible to adversarial attacks, making it imperative for us to address the challenge of their adversarial robustness. Existing techniques for adversarial robustness fall into three broad categories: defensive distillation techniques, adversarial training techniques, and randomized or non-deterministic model based techniques. In this paper, we propose a novel neural network paradigm that falls under the category of randomized models for adversarial robustness, but differs from all existing techniques under this category in that it models each parameter of the network as a statistical distribution with learnable parameters. We show experimentally that this framework is highly robust to a variety of white-box and black-box adversarial attacks, while preserving the task-specific performance of the traditional neural network model.

References in corpus (12)

• Distilling the Knowledge in a Neural Network
• Explaining and Harnessing Adversarial Examples
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• Adversarial Machine Learning at Scale
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Defensive Distillation is Not Robust to Adversarial Examples
• Mitigating Adversarial Effects Through Randomization
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Attacks Against Medical Deep Learning Systems
• Dropout is a special case of the stochastic delta rule: faster and more accurate deep learning