RANDOM MASK: Towards Robust Convolutional Neural Networks

Abstract

Robustness of neural networks has recently been highlighted by the adversarial examples, i.e., inputs added with well-designed perturbations which are imperceptible to humans but can cause the network to give incorrect outputs. In this paper, we design a new CNN architecture that by itself has good robustness. We introduce a simple but powerful technique, Random Mask, to modify existing CNN structures. We show that CNN with Random Mask achieves state-of-the-art performance against black-box adversarial attacks without applying any adversarial training. We next investigate the adversarial examples which 'fool' a CNN with Random Mask. Surprisingly, we find that these adversarial examples often 'fool' humans as well. This raises fundamental questions on how to define adversarial examples and robustness properly.

arXiv admin note: substantial text overlap with arXiv:1911.08432

References in corpus (9)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Show, Attend and Tell: Neural Image Caption Generation with Visual Attention
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• On the (Statistical) Detection of Adversarial Examples
• Learning with a Strong Adversary
• Stochastic Activation Pruning for Robust Adversarial Defense
• Defense Against the Dark Arts: An overview of adversarial example security research and future research directions

Cited by in corpus (5)

• Smooth Adversarial Training
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Towards Compact and Robust Deep Neural Networks