Adversarial Feature Desensitization
arXiv:2006.04621
Abstract
Neural networks are known to be vulnerable to adversarial attacks -- slight but carefully constructed perturbations of the inputs which can drastically impair the network's performance. Many defense methods have been proposed for improving robustness of deep networks by training them on adversarially perturbed inputs. However, these models often remain vulnerable to new types of attacks not seen during training, and even to slightly stronger versions of previously seen attacks. In this work, we propose a novel approach to adversarial robustness, which builds upon the insights from the domain adaptation field. Our method, called Adversarial Feature Desensitization (AFD), aims at learning features that are invariant towards adversarial perturbations of the inputs. This is achieved through a game where we learn features that are both predictive and robust (insensitive to adversarial attacks), i.e. cannot be used to discriminate between natural and adversarial data. Empirical results on several benchmarks demonstrate the effectiveness of the proposed approach against a wide range of attack types and attack strengths. Our code is available at https://github.com/BashivanLab/afd.
arXiv commentAccepted at Neurips 2021
References in corpus (25)
- Intriguing properties of neural networks
- Spectral Normalization for Generative Adversarial Networks
- Ensemble Adversarial Training: Attacks and Defenses
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Theoretically Principled Trade-off between Robustness and Accuracy
- Certified Adversarial Robustness via Randomized Smoothing
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
- cGANs with Projection Discriminator
- Deep multi-scale video prediction beyond mean square error
- Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
- Exploring the Landscape of Spatial Robustness
- Stochastic Adversarial Video Prediction
- Adversarial Robustness through Local Linearization
- advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
- Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
- Improving the Generalization of Adversarial Training with Domain Adaptation
- MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
- Improving Adversarial Robustness via Channel-wise Activation Suppressing
- Robust Local Features for Improving the Generalization of Adversarial Training
- A Direct Approach to Robust Deep Learning Using Adversarial Networks
- Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses
- Improved Network Robustness with Adversary Critic
- Learning Adversarially Robust Representations via Worst-Case Mutual Information Maximization
- Tensor Product Generation Networks for Deep NLP Modeling
- Propagated Perturbation of Adversarial Attack for well-known CNNs: Empirical Study and its Explanation