Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness

Abstract

Mode connectivity provides novel geometric insights on analyzing loss landscapes and enables building high-accuracy pathways between well-trained neural networks. In this work, we propose to employ mode connectivity in loss landscapes to study the adversarial robustness of deep neural networks, and provide novel methods for improving this robustness. Our experiments cover various types of adversarial attacks applied to different network architectures and datasets. When network models are tampered with backdoor or error-injection attacks, our results demonstrate that the path connection learned using limited amount of bonafide data can effectively mitigate adversarial effects while maintaining the original accuracy on clean data. Therefore, mode connectivity provides users with the power to repair backdoored or error-injected models. We also use mode connectivity to investigate the loss landscapes of regular and robust models against evasion attacks. Experiments show that there exists a barrier in adversarial robustness loss on the path connecting regular and adversarially-trained models. A high correlation is observed between the adversarial robustness loss and the largest eigenvalue of the input Hessian matrix, for which theoretical justifications are provided. Our results suggest that mode connectivity offers a holistic tool and practical means for evaluating and improving adversarial robustness.

arXiv commentaccepted by ICLR 2020

References in corpus (11)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Poisoning Attacks against Support Vector Machines
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Towards Understanding Generalization of Deep Learning: Perspective of Loss Landscapes
• Identifying Generalization Properties in Neural Networks
• Interpreting Adversarial Robustness: A View from Decision Surface in Input Space
• Towards Robust Deep Neural Networks
• Using Mode Connectivity for Loss Landscape Analysis

Cited by in corpus (12)

• Input-Aware Dynamic Backdoor Attack
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• WaNet -- Imperceptible Warping-based Backdoor Attack
• Rethinking the Trigger of Backdoor Attack
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
• Backdoor Attack through Frequency Domain
• How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data
• Optimizing Mode Connectivity via Neuron Alignment
• Formalizing Generalization and Robustness of Neural Networks to Weight Perturbations
• Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor
• On the Orthogonality of Knowledge Distillation with Other Techniques: From an Ensemble Perspective