Adversarial Robustness Against the Union of Multiple Perturbation Models

Abstract

Owing to the susceptibility of deep learning systems to adversarial attacks, there has been a great deal of work in developing (both empirically and certifiably) robust classifiers. While most work has defended against a single type of attack, recent work has looked at defending against multiple perturbation models using simple aggregations of multiple attacks. However, these methods can be difficult to tune, and can easily result in imbalanced degrees of robustness to individual perturbation models, resulting in a sub-optimal worst-case loss over the union. In this work, we develop a natural generalization of the standard PGD-based procedure to incorporate multiple perturbation models into a single attack, by taking the worst-case over all steepest descent directions. This approach has the advantage of directly converging upon a trade-off between different perturbation models which minimizes the worst-case performance over the union. With this approach, we are able to train standard architectures which are simultaneously robust against ${\ell }_{\infty }$, ${\ell }_2$, and ${\ell }_1$ attacks, outperforming past approaches on the MNIST and CIFAR10 datasets and achieving adversarial accuracy of 47.0% against the union of (${\ell }_{\infty }$, ${\ell }_2$, ${\ell }_1$) perturbations with radius = (0.03, 0.5, 12) on the latter, improving upon previous approaches which achieve 40.6% accuracy.

arXiv commentICML 2020 Final Version

References in corpus (9)

• A disciplined approach to neural network hyper-parameters: Part 1 -- learning rate, batch size, momentum, and weight decay
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Towards the first adversarially robust neural network model on MNIST
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Evaluating and Understanding the Robustness of Adversarial Logit Pairing
• Quantifying Perceptual Distortion of Adversarial Examples
• Transfer of Adversarial Robustness Between Perturbation Types

Cited by in corpus (16)

• RobustBench: a standardized adversarial robustness benchmark
• Adversarial Training against Location-Optimized Adversarial Patches
• RoPGen: Towards Robust Code Authorship Attribution via Automatic Coding Style Transformation
• Learning perturbation sets for robust machine learning
• Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks
• Manifold Regularization for Locally Stable Deep Neural Networks
• Bit Error Robustness for Energy-Efficient DNN Accelerators
• A Comprehensive Evaluation Framework for Deep Model Robustness
• Towards Defending Multiple ${\ell }_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization
• Mind the box: $l_1$-APGD for sparse adversarial attacks on image classifiers
• Bridging the Gap Between Adversarial Robustness and Optimization Bias
• Towards Robust Off-Policy Evaluation via Human Inputs
• Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations
• Towards a constructive framework for control theory
• Towards Deep Learning Models Resistant to Large Perturbations
• Towards Optimal Randomized Strategies in Adversarial Example Game