Jacobian Adversarially Regularized Networks for Robustness

Abstract

Adversarial examples are crafted with imperceptible perturbations with the intent to fool neural networks. Against such attacks, adversarial training and its variants stand as the strongest defense to date. Previous studies have pointed out that robust models that have undergone adversarial training tend to produce more salient and interpretable Jacobian matrices than their non-robust counterparts. A natural question is whether a model trained with an objective to produce salient Jacobian can result in better robustness. This paper answers this question with affirmative empirical results. We propose Jacobian Adversarially Regularized Networks (JARN) as a method to optimize the saliency of a classifier's Jacobian by adversarially regularizing the model's Jacobian to resemble natural training images. Image classifiers trained with JARN show improved robust accuracy compared to standard models on the MNIST, SVHN and CIFAR-10 datasets, uncovering a new angle to boost robustness without using adversarial training examples.

ICLR 2020 Camera Ready

References in corpus (19)

• End to End Learning for Self-Driving Cars
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Autoencoding beyond pixels using a learned similarity metric
• On Evaluating Adversarial Robustness
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Robustness May Be at Odds with Accuracy
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Adversarial Robustness through Local Linearization
• Semidefinite relaxations for certifying robustness to adversarial examples
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• Diagnosing and Enhancing VAE Models
• First-order Adversarial Vulnerability of Neural Networks and Input Dimension
• Robust Learning with Jacobian Regularization
• PROVEN: Certifying Robustness of Neural Networks with a Probabilistic Approach

Cited by in corpus (3)

• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• What it Thinks is Important is Important: Robustness Transfers through Input Gradients
• Improving Resistance to Adversarial Deformations by Regularizing Gradients