Defense Through Diverse Directions

Abstract

In this work we develop a novel Bayesian neural network methodology to achieve strong adversarial robustness without the need for online adversarial training. Unlike previous efforts in this direction, we do not rely solely on the stochasticity of network weights by minimizing the divergence between the learned parameter distribution and a prior. Instead, we additionally require that the model maintain some expected uncertainty with respect to all input covariates. We demonstrate that by encouraging the network to distribute evenly across inputs, the network becomes less susceptible to localized, brittle features which imparts a natural robustness to targeted perturbations. We show empirical robustness on several benchmark datasets.

References in corpus (15)

• Auto-Encoding Variational Bayes
• Ensemble Adversarial Training: Attacks and Defenses
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• Countering Adversarial Images using Input Transformations
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Stochastic Activation Pruning for Robust Adversarial Defense
• Flipout: Efficient Pseudo-Independent Weight Perturbations on Mini-Batches
• Adversarial Examples that Fool both Computer Vision and Time-Limited Humans
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• The Limitations of Adversarial Training and the Blind-Spot Attack