Adversarial Distributional Training for Robust Deep Learning

Abstract

Adversarial training (AT) is among the most effective techniques to improve model robustness by augmenting training data with adversarial examples. However, most existing AT methods adopt a specific attack to craft adversarial examples, leading to the unreliable robustness against other unseen attacks. Besides, a single attack algorithm could be insufficient to explore the space of perturbations. In this paper, we introduce adversarial distributional training (ADT), a novel framework for learning robust models. ADT is formulated as a minimax optimization problem, where the inner maximization aims to learn an adversarial distribution to characterize the potential adversarial examples around a natural one under an entropic regularizer, and the outer minimization aims to train robust models by minimizing the expected loss over the worst-case adversarial distributions. Through a theoretical analysis, we develop a general algorithm for solving ADT, and present three approaches for parameterizing the adversarial distributions, ranging from the typical Gaussian distributions to the flexible implicit ones. Empirical results on several benchmarks validate the effectiveness of ADT compared with the state-of-the-art AT methods.

arXiv commentNeurIPS 2020. The first two authors contribute equally

References in corpus (30)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Auto-Encoding Variational Bayes
• Soft Actor-Critic: Off-Policy Maximum Entropy Deep Reinforcement Learning with a Stochastic Actor
• Ensemble Adversarial Training: Attacks and Defenses
• Weight Uncertainty in Neural Networks
• Theoretically Principled Trade-off between Robustness and Accuracy
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Fast is better than free: Revisiting adversarial training
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Exploring the Landscape of Spatial Robustness
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Multiplicative Normalizing Flows for Variational Bayesian Neural Networks
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Adversarial Robustness through Local Linearization
• Are Labels Required for Improving Adversarial Robustness?
• Improving Black-box Adversarial Attacks with a Transfer-based Prior
• On Adaptive Attacks to Adversarial Example Defenses
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Structured and Efficient Variational Deep Learning with Matrix Gaussian Posteriors
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Metric Learning for Adversarial Robustness
• Diversity can be Transferred: Output Diversification for White- and Black-box Attacks
• A Spectral Approach to Gradient Estimation for Implicit Distributions
• Learning to Defend by Learning to Attack
• A Direct Approach to Robust Deep Learning Using Adversarial Networks

Cited by in corpus (11)

• Recent Advances in Adversarial Training for Adversarial Robustness
• Robust Spatiotemporal Traffic Forecasting with Reinforced Dynamic Adversarial Training
• Exploring Memorization in Adversarial Training
• Bag of Tricks for Adversarial Training
• Rethinking Natural Adversarial Examples for Classification Models
• Learning Diverse-Structured Networks for Adversarial Robustness
• Long-term Cross Adversarial Training: A Robust Meta-learning Method for Few-shot Classification Tasks
• Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness
• Adversarial Attacks on ML Defense Models Competition
• Adversarial Purification through Representation Disentanglement
• Human Imperceptible Attacks and Applications to Improve Fairness