Robustness of Bayesian Neural Networks to Gradient-Based Attacks

Abstract

Vulnerability to adversarial attacks is one of the principal hurdles to the adoption of deep learning in safety-critical applications. Despite significant efforts, both practical and theoretical, the problem remains open. In this paper, we analyse the geometry of adversarial attacks in the large-data, overparametrized limit for Bayesian Neural Networks (BNNs). We show that, in the limit, vulnerability to gradient-based attacks arises as a result of degeneracy in the data distribution, i.e., when the data lies on a lower-dimensional submanifold of the ambient space. As a direct consequence, we demonstrate that in the limit BNN posteriors are robust to gradient-based adversarial attacks. Experimental results on the MNIST and Fashion MNIST datasets with BNNs trained with Hamiltonian Monte Carlo and Variational Inference support this line of argument, showing that BNNs can display both high accuracy and robustness to gradient based adversarial attacks.

References in corpus (16)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Weight Uncertainty in Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• A Mean Field View of the Landscape of Two-Layers Neural Networks
• Detecting Adversarial Samples from Artifacts
• Black-box Adversarial Attacks with Limited Queries and Information
• Adversarial vulnerability for any classifier
• Dropout Inference in Bayesian Neural Networks with Alpha-divergences
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• On the Geometry of Adversarial Examples
• Sufficient Conditions for Idealised Models to Have No Adversarial Examples: a Theoretical and Empirical Study with Bayesian Neural Networks
• Adversarial Phenomenon in the Eyes of Bayesian Deep Learning
• Adversarial Robustness Guarantees for Classification with Gaussian Processes
• Bayesian Adversarial Spheres: Bayesian Inference and Adversarial Examples in a Noiseless Setting

Cited by in corpus (10)

• A Review of Uncertainty Quantification in Deep Learning: Techniques, Applications and Challenges
• Learning Uncertainty with Artificial Neural Networks for Improved Predictive Process Monitoring
• Defense against adversarial attacks on deep convolutional neural networks through nonlocal denoising
• Bayesian Inference with Certifiable Adversarial Robustness
• Dangers of Bayesian Model Averaging under Covariate Shift
• Artificial Neural Variability for Deep Learning: On Overfitting, Noise Memorization, and Catastrophic Forgetting
• Probabilistic Safety for Bayesian Neural Networks
• Efficient and Transferable Adversarial Examples from Bayesian Neural Networks
• The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks
• Localized Uncertainty Attacks