A Closer Look at Accuracy vs. Robustness

Abstract

Current methods for training robust networks lead to a drop in test accuracy, which has led prior works to posit that a robustness-accuracy tradeoff may be inevitable in deep learning. We take a closer look at this phenomenon and first show that real image datasets are actually separated. With this property in mind, we then prove that robustness and accuracy should both be achievable for benchmark datasets through locally Lipschitz functions, and hence, there should be no inherent tradeoff between robustness and accuracy. Through extensive experiments with robustness methods, we argue that the gap between theory and practice arises from two limitations of current methods: either they fail to impose local Lipschitzness or they are insufficiently generalized. We explore combining dropout with robust training methods and obtain better generalization. We conclude that achieving robustness and accuracy in practice may require using methods that impose local Lipschitzness and augmenting them with deep learning generalization techniques. Code available at https://github.com/yangarbiter/robust-local-lipschitz

References in corpus (43)

• Adam: A Method for Stochastic Optimization
• Neural Architecture Search with Reinforcement Learning
• Theoretically Principled Trade-off between Robustness and Accuracy
• Delving into Transferable Adversarial Examples and Black-box Attacks
• PathNet: Evolution Channels Gradient Descent in Super Neural Networks
• Certified Adversarial Robustness via Randomized Smoothing
• Adversarially Robust Generalization Requires More Data
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Robustness and Regularization of Support Vector Machines
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Adversarial Robustness through Local Linearization
• Are Labels Required for Improving Adversarial Robustness?
• Convolutional Neural Fabrics
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach
• Adversarial vulnerability for any classifier
• Adversarial Training Can Hurt Generalization
• Adversarial examples from computational constraints
• Analyzing the Robustness of Nearest Neighbors to Adversarial Examples
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• Overfitting in adversarially robust deep learning
• Theoretical evidence for adversarial robustness through randomization
• Lower Bounds on Adversarial Robustness from Optimal Transport
• Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning
• Generalized No Free Lunch Theorem for Adversarial Robustness
• L2-Nonexpansive Neural Networks
• Randomized Smoothing of All Shapes and Sizes
• Lipschitz regularized Deep Neural Networks generalize and are adversarially robust
• When NAS Meets Robustness: In Search of Robust Architectures against Adversarial Attacks
• On Robustness to Adversarial Examples and Polynomial Optimization
• Robustness for Non-Parametric Classification: A Generic Attack and Defense
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• A Spectral View of Adversarially Robust Features
• A Bayes-Optimal View on Adversarial Examples
• Toward Adversarial Robustness via Semi-supervised Robust Training
• Analyzing Accuracy Loss in Randomized Smoothing Defenses
• Understanding the Intrinsic Robustness of Image Distributions using Conditional Generative Models
• Where is the Bottleneck of Adversarial Learning with Unlabeled Data?
• When are Non-Parametric Methods Robust?

Cited by in corpus (17)

• Trustworthy AI and Robotics and the Implications for the AEC Industry: A Systematic Literature Review and Future Potentials
• EllSeg-Gen, towards Domain Generalization for head-mounted eyetracking
• How benign is benign overfitting?
• Understanding Generalization in Adversarial Training via the Bias-Variance Decomposition
• Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention
• SOAR: Second-Order Adversarial Regularization
• Adversarial robustness via robust low rank representations
• Data Quality Matters For Adversarial Training: An Empirical Study
• Adversarially Regularized Policy Learning Guided by Trajectory Optimization
• Enhancing Mixup-based Semi-Supervised Learning with Explicit Lipschitz Regularization
• Certifiably Robust Variational Autoencoders
• Adversarial Training for Face Recognition Systems using Contrastive Adversarial Learning and Triplet Loss Fine-tuning
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• Less is More: Feature Selection for Adversarial Robustness with Compressive Counter-Adversarial Attacks
• The Interplay between Distribution Parameters and the Accuracy-Robustness Tradeoff in Classification
• The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks
• Noisy Feature Mixup