Smoothed Inference for Adversarially-Trained Models

Abstract

Deep neural networks are known to be vulnerable to adversarial attacks. Current methods of defense from such attacks are based on either implicit or explicit regularization, e.g., adversarial training. Randomized smoothing, the averaging of the classifier outputs over a random distribution centered in the sample, has been shown to guarantee the performance of a classifier subject to bounded perturbations of the input. In this work, we study the application of randomized smoothing as a way to improve performance on unperturbed data as well as to increase robustness to adversarial attacks. The proposed technique can be applied on top of any existing adversarial defense, but works particularly well with the randomized approaches. We examine its performance on common white-box (PGD) and black-box (transfer and NAttack) attacks on CIFAR-10 and CIFAR-100, substantially outperforming previous art for most scenarios and comparable on others. For example, we achieve 60.4% accuracy under a PGD attack on CIFAR-10 using ResNet-20, outperforming previous art by 11.7%. Since our method is based on sampling, it lends itself well for trading-off between the model inference complexity and its performance. A reference implementation of the proposed techniques is provided at https://github.com/yanemcovsky/SIAM

References in corpus (28)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Variational Dropout and the Local Reparameterization Trick
• Adversarial Examples Are Not Bugs, They Are Features
• Robustness and Regularization of Support Vector Machines
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• On the Convergence and Robustness of Adversarial Training
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• Adversarial Policies: Attacking Deep Reinforcement Learning
• Improving the Robustness of Deep Neural Networks via Stability Training
• Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Are Perceptually-Aligned Gradients a General Property of Robust Classifiers?
• MaxUp: A Simple Way to Improve Generalization of Neural Network Training
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• A Kernel Perspective for Regularizing Deep Neural Networks
• Randomized Smoothing of All Shapes and Sizes
• Learning to Defend by Learning to Attack
• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• Adversarial Training with Voronoi Constraints
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• Training Robust Deep Neural Networks via Adversarial Noise Propagation
• Exploring the Robustness of NMT Systems to Nonsensical Inputs
• Colored Noise Injection for Training Adversarially Robust Neural Networks