Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
arXiv:2001.11055
Abstract
We cannot guarantee that training datasets are representative of the distribution of inputs that will be encountered during deployment. So we must have confidence that our models do not over-rely on this assumption. To this end, we introduce a new method that identifies context-sensitive feature perturbations (e.g. shape, location, texture, colour) to the inputs of image classifiers. We produce these changes by performing small adjustments to the activation values of different layers of a trained generative neural network. Perturbing at layers earlier in the generator causes changes to coarser-grained features; perturbations further on cause finer-grained changes. Unsurprisingly, we find that state-of-the-art classifiers are not robust to any such changes. More surprisingly, when it comes to coarse-grained feature changes, we find that adversarial training against pixel-space perturbations is not just unhelpful: it is counterproductive.
References in corpus (23)
- Conditional Generative Adversarial Nets
- Large Scale GAN Training for High Fidelity Natural Image Synthesis
- NIPS 2016 Tutorial: Generative Adversarial Networks
- Can You Trust Your Model's Uncertainty? Evaluating Predictive Uncertainty Under Dataset Shift
- ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
- Fast is better than free: Revisiting adversarial training
- Generating Natural Adversarial Examples
- Generalisation in humans and deep neural networks
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- Exploring the Landscape of Spatial Robustness
- Defensive Distillation is Not Robust to Adversarial Examples
- Measuring the tendency of CNNs to Learn Surface Statistical Regularities
- Natural Adversarial Examples
- Motivating the Rules of the Game for Adversarial Example Research
- advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
- Benchmarking Robustness in Object Detection: Autonomous Driving when Winter is Coming
- Testing Robustness Against Unforeseen Adversaries
- Unrestricted Adversarial Examples via Semantic Manipulation
- Fixing the train-test resolution discrepancy: FixEfficientNet
- Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
- Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer
- Generating Semantic Adversarial Examples via Feature Manipulation
- Adaptive Generation of Unrestricted Adversarial Inputs