Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks

Abstract

Adversarial training yields robust models against a specific threat model, e.g., $L_{\infty }$ adversarial examples. Typically robustness does not generalize to previously unseen threat models, e.g., other $L_p$ norms, or larger perturbations. Our confidence-calibrated adversarial training (CCAT) tackles this problem by biasing the model towards low confidence predictions on adversarial examples. By allowing to reject examples with low confidence, robustness generalizes beyond the threat model employed during training. CCAT, trained only on $L_{\infty }$ adversarial examples, increases robustness against larger $L_{\infty }$, $L_2$, $L_1$ and $L_0$ attacks, adversarial frames, distal adversarial examples and corrupted examples and yields better clean accuracy compared to adversarial training. For thorough evaluation we developed novel white- and black-box attacks directly attacking CCAT by maximizing confidence. For each threat model, we use $7$ attacks with up to $50$ restarts and $5000$ iterations and report worst-case robust test error, extended to our confidence-thresholded setting, across all attacks.

References in corpus (31)

• Scikit-learn: Machine Learning in Python
• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Adversarially Robust Generalization Requires More Data
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• On the (Statistical) Detection of Adversarial Examples
• Distributional Smoothing with Virtual Adversarial Training
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Learning with a Strong Adversary
• Exploring the Landscape of Spatial Robustness
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• Towards the first adversarially robust neural network model on MNIST
• On Detecting Adversarial Perturbations
• Are Labels Required for Improving Adversarial Robustness?
• Early Methods for Detecting Adversarial Images
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• On the Geometry of Adversarial Examples
• Curriculum Adversarial Training
• Comment on "Biologically inspired protection of deep networks from adversarial attacks"
• Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness
• Playing the Game of Universal Adversarial Perturbations
• Playing it Safe: Adversarial Robustness with an Abstain Option

Cited by in corpus (4)

• Adversarial Examples Improve Image Recognition
• Learning perturbation sets for robust machine learning
• The Intriguing Relation Between Counterfactual Explanations and Adversarial Examples
• Localized Uncertainty Attacks