Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
arXiv:1907.11780
Abstract
Deep models, while being extremely versatile and accurate, are vulnerable to adversarial attacks: slight perturbations that are imperceptible to humans can completely flip the prediction of deep models. Many attack and defense mechanisms have been proposed, although a satisfying solution still largely remains elusive. In this work, we give strong evidence that during training, deep models maximize the minimum margin in order to achieve high accuracy, but at the same time decrease the \emph{average} margin hence hurting robustness. Our empirical results highlight an intrinsic trade-off between accuracy and robustness for current deep model training. To further address this issue, we propose a new regularizer to explicitly promote average margin, and we verify through extensive experiments that it does lead to better robustness. Our regularized objective remains Fisher-consistent, hence asymptotically can still recover the Bayes optimal classifier.
References in corpus (14)
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Defenses against Adversarial Examples
- Efficient Neural Network Robustness Certification with General Activation Functions
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
- Semidefinite relaxations for certifying robustness to adversarial examples
- Gradient descent aligns the layers of deep linear networks
- Sparse DNNs with Improved Adversarial Robustness
- Deep Defense: Training DNNs with Improved Adversarial Robustness
- Provable Robustness of ReLU networks via Maximization of Linear Regions
- Towards Robust, Locally Linear Deep Networks