MadNet: Using a MAD Optimization for Defending Against Adversarial Attacks
arXiv:1911.00870
Abstract
This paper is concerned with the defense of deep models against adversarial attacks. Inspired by the certificate defense approach, we propose a maximal adversarial distortion (MAD) optimization method for robustifying deep networks. MAD captures the idea of increasing separability of class clusters in the embedding space while decreasing the network sensitivity to small distortions. Given a deep neural network (DNN) for a classification problem, an application of MAD optimization results in MadNet, a version of the original network, now equipped with an adversarial defense mechanism. MAD optimization is intuitive, effective and scalable, and the resulting MadNet can improve the original accuracy. We present an extensive empirical study demonstrating that MadNet improves adversarial robustness performance compared to state-of-the-art methods.
References in corpus (22)
- Ensemble Adversarial Training: Attacks and Defenses
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- When Does Label Smoothing Help?
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Adversarial Robustness via Randomized Smoothing
- On Evaluating Adversarial Robustness
- Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
- Detecting Adversarial Samples from Artifacts
- Evaluating Robustness of Neural Networks with Mixed Integer Programming
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
- Robust Large Margin Deep Neural Networks
- Stochastic Activation Pruning for Robust Adversarial Defense
- Improving Adversarial Robustness via Promoting Ensemble Diversity
- MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
- MMA Training: Direct Input Space Margin Maximization through Adversarial Training
- Deep Defense: Training DNNs with Improved Adversarial Robustness
- Evaluating and Understanding the Robustness of Adversarial Logit Pairing
- Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks
- Interpreting Adversarial Robustness: A View from Decision Surface in Input Space
- Detecting Adversarial Examples via Neural Fingerprinting