Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks

Abstract

It has been widely recognized that adversarial examples can be easily crafted to fool deep networks, which mainly root from the locally non-linear behavior nearby input examples. Applying mixup in training provides an effective mechanism to improve generalization performance and model robustness against adversarial perturbations, which introduces the globally linear behavior in-between training examples. However, in previous work, the mixup-trained models only passively defend adversarial attacks in inference by directly classifying the inputs, where the induced global linearity is not well exploited. Namely, since the locality of the adversarial perturbations, it would be more efficient to actively break the locality via the globality of the model predictions. Inspired by simple geometric intuition, we develop an inference principle, named mixup inference (MI), for mixup-trained models. MI mixups the input with other random clean samples, which can shrink and transfer the equivalent perturbation if the input is adversarial. Our experiments on CIFAR-10 and CIFAR-100 demonstrate that MI can further improve the adversarial robustness for the models trained by mixup and its variants.

arXiv commentICLR 2020

References in corpus (11)

• Theoretically Principled Trade-off between Robustness and Accuracy
• Interpolation Consistency Training for Semi-Supervised Learning
• On Evaluating Adversarial Robustness
• Data Augmentation by Pairing Samples for Images Classification
• Learning from Between-class Examples for Deep Sound Recognition
• Adversarial vulnerability for any classifier
• Robustness of classifiers: from adversarial to random noise
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• Max-Mahalanobis Linear Discriminant Analysis Networks
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Data Interpolating Prediction: Alternative Interpretation of Mixup

Cited by in corpus (5)

• Long-tailed Visual Recognition via Gaussian Clouded Logit Adjustment
• i-Mix: A Domain-Agnostic Strategy for Contrastive Representation Learning
• Greedy Policy Search: A Simple Baseline for Learnable Test-Time Augmentation
• Adversarial robustness via stochastic regularization of neural activation sensitivity
• Likelihood Landscapes: A Unifying Principle Behind Many Adversarial Defenses