Improving Resistance to Adversarial Deformations by Regularizing Gradients

Abstract

Improving the resistance of deep neural networks against adversarial attacks is important for deploying models to realistic applications. However, most defense methods are designed to defend against intensity perturbations and ignore location perturbations, which should be equally important for deep model security. In this paper, we focus on adversarial deformations, a typical class of location perturbations, and propose a flow gradient regularization to improve the resistance of models. Theoretically, we prove that, compared with input gradient regularization, regularizing flow gradients is able to get a tighter bound. Over multiple datasets, architectures, and adversarial deformations, our empirical results indicate that models trained with flow gradients can acquire a better resistance than trained with input gradients with a large margin, and also better than adversarial training. Moreover, compared with directly training with adversarial deformations, our method can achieve better results in unseen attacks, and combining these two methods can improve the resistance further.

References in corpus (21)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Certified Defenses against Adversarial Examples
• Countering Adversarial Images using Input Transformations
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Spatially Transformed Adversarial Examples
• Generating Adversarial Examples with Adversarial Networks
• Mitigating Adversarial Effects Through Randomization
• DPatch: An Adversarial Patch Attack on Object Detectors
• On Adaptive Attacks to Adversarial Example Defenses
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
• First-order Adversarial Vulnerability of Neural Networks and Input Dimension
• Robust Learning with Jacobian Regularization
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Jacobian Adversarially Regularized Networks for Robustness
• Joint Adversarial Training: Incorporating both Spatial and Pixel Attacks
• Learning with Multiplicative Perturbations