Improved Image Wasserstein Attacks and Defenses

Abstract

Robustness against image perturbations bounded by a ${\ell }_p$ ball have been well-studied in recent literature. Perturbations in the real-world, however, rarely exhibit the pixel independence that ${\ell }_p$ threat models assume. A recently proposed Wasserstein distance-bounded threat model is a promising alternative that limits the perturbation to pixel mass movements. We point out and rectify flaws in previous definition of the Wasserstein threat model and explore stronger attacks and defenses under our better-defined framework. Lastly, we discuss the inability of current Wasserstein-robust models in defending against perturbations seen in the real world. Our code and trained models are available at https://github.com/edwardjhu/improved_wasserstein .

arXiv commentBest paper award at ICLR Trustworthy ML Workshop 2020

References in corpus (8)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Defenses against Adversarial Examples
• A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
• Functional Adversarial Attacks
• Adversarial Robustness as a Prior for Learned Representations
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• Towards Verifying Robustness of Neural Networks Against Semantic Perturbations

Cited by in corpus (3)

• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Randomized Smoothing of All Shapes and Sizes
• Group-Structured Adversarial Training