Towards Deep Learning Models Resistant to Large Perturbations

Abstract

Adversarial robustness has proven to be a required property of machine learning algorithms. A key and often overlooked aspect of this problem is to try to make the adversarial noise magnitude as large as possible to enhance the benefits of the model robustness. We show that the well-established algorithm called "adversarial training" fails to train a deep neural network given a large, but reasonable, perturbation magnitude. In this paper, we propose a simple yet effective initialization of the network weights that makes learning on higher levels of noise possible. We next evaluate this idea rigorously on MNIST ($\epsilon$ up to $\approx 0.40$) and CIFAR10 ($\epsilon$ up to $\approx 32/255$) datasets assuming the ${\ell }_{\infty }$ attack model. Additionally, in order to establish the limits of $\epsilon$ in which the learning is feasible, we study the optimal robust classifier assuming full access to the joint data and label distribution. Then, we provide some theoretical results on the adversarial accuracy for a simple multi-dimensional Bernoulli distribution, which yields some insights on the range of feasible perturbations for the MNIST dataset.

References in corpus (40)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Explaining NonLinear Classification Decisions with Deep Taylor Decomposition
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Certified Adversarial Robustness via Randomized Smoothing
• On Evaluating Adversarial Robustness
• Adversarially Robust Generalization Requires More Data
• Fast is better than free: Revisiting adversarial training
• Achieving Human Parity in Conversational Speech Recognition
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Adversarial Machine Learning at Scale
• Robustness May Be at Odds with Accuracy
• Black-box Adversarial Attacks with Limited Queries and Information
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Defensive Distillation is Not Robust to Adversarial Examples
• Towards the first adversarially robust neural network model on MNIST
• Qualitatively characterizing neural network optimization problems
• Essentially No Barriers in Neural Network Energy Landscape
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Adversarial examples from computational constraints
• Rademacher Complexity for Adversarially Robust Generalization
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Practical Black-Box Attacks against Machine Learning
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Convergence of Adversarial Training in Overparametrized Neural Networks
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Competitive Gradient Descent
• VC Classes are Adversarially Robustly Learnable, but Only Improperly
• Explaining Landscape Connectivity of Low-cost Solutions for Multilayer Nets
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Adversarial Music: Real World Audio Adversary Against Wake-word Detection System
• Adversarial Risk Bounds via Function Transformation
• Is AmI (Attacks Meet Interpretability) Robust to Adversarial Examples?
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• PAC-learning in the presence of evasion adversaries
• Lower Bounds for Adversarially Robust PAC Learning

Cited by in corpus (2)

• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Bridged Adversarial Training