Adversarial Robustness as a Prior for Learned Representations

Abstract

An important goal in deep learning is to learn versatile, high-level feature representations of input data. However, standard networks' representations seem to possess shortcomings that, as we illustrate, prevent them from fully realizing this goal. In this work, we show that robust optimization can be re-cast as a tool for enforcing priors on the features learned by deep neural networks. It turns out that representations learned by robust models address the aforementioned shortcomings and make significant progress towards learning a high-level encoding of inputs. In particular, these representations are approximately invertible, while allowing for direct visualization and manipulation of salient input features. More broadly, our results indicate adversarial robustness as a promising avenue for improving learned representations. Our code and models for reproducing these results is available at https://git.io/robust-reps .

References in corpus (13)

• Distributed Representations of Words and Phrases and their Compositionality
• Auto-Encoding Variational Bayes
• DeCAF: A Deep Convolutional Activation Feature for Generic Visual Recognition
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Understanding Neural Networks Through Deep Visualization
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• NICE: Non-linear Independent Components Estimation
• ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
• Sanity Checks for Saliency Maps
• The (Un)reliability of saliency methods
• Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNet
• Interpreting Adversarially Trained Convolutional Neural Networks
• With Friends Like These, Who Needs Adversaries?

Cited by in corpus (41)

• On Adaptive Attacks to Adversarial Example Defenses
• The Origins and Prevalence of Texture Bias in Convolutional Neural Networks
• Do Adversarially Robust ImageNet Models Transfer Better?
• Benchmarking Attribution Methods with Relative Feature Importance
• Partial success in closing the gap between human and machine vision
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
• Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networks
• Robustness properties of Facebook's ResNeXt WSL models
• How Well do Feature Visualizations Support Causal Understanding of CNN Activations?
• On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learning
• Poisoned classifiers are not only backdoored, they are fundamentally broken
• Biologically Inspired Mechanisms for Adversarial Robustness
• SafeAMC: Adversarial training for robust modulation recognition models
• Improved Image Wasserstein Attacks and Defenses
• Enhancing Deep Neural Network Saliency Visualizations with Gradual Extrapolation
• Learning Adversarially Robust Representations via Worst-Case Mutual Information Maximization
• Rethinking the Role of Gradient-Based Attribution Methods for Model Interpretability
• Transferred Discrepancy: Quantifying the Difference Between Representations
• Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Better
• Improving Interpretability in Medical Imaging Diagnosis using Adversarial Training
• An empirical study of pretrained representations for few-shot classification
• Leveraging Sparse Linear Layers for Debuggable Deep Networks
• Adversarial Robustness for Unsupervised Domain Adaptation
• On the human-recognizability phenomenon of adversarially trained deep image classifiers
• Bio-inspired Robustness: A Review
• Adaptive Clustering of Robust Semantic Representations for Adversarial Image Purification
• Sensory Optimization: Neural Networks as a Model for Understanding and Creating Art
• Do Input Gradients Highlight Discriminative Features?
• Energy Attack: On Transferring Adversarial Examples
• An Experimental Study of Semantic Continuity for Deep Learning Models
• Combining Diverse Feature Priors
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses
• Noisy Feature Mixup
• Coded-InvNet for Resilient Prediction Serving Systems
• Deep Adversarially-Enhanced k-Nearest Neighbors
• Reinforcement Based Learning on Classification Task Could Yield Better Generalization and Adversarial Accuracy
• Hard-label Manifolds: Unexpected Advantages of Query Efficiency for Finding On-manifold Adversarial Examples
• HAD-GAN: A Human-perception Auxiliary Defense GAN to Defend Adversarial Examples
• Decoder-free Robustness Disentanglement without (Additional) Supervision