DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles

Abstract

Recent research finds CNN models for image classification demonstrate overlapped adversarial vulnerabilities: adversarial attacks can mislead CNN models with small perturbations, which can effectively transfer between different models trained on the same dataset. Adversarial training, as a general robustness improvement technique, eliminates the vulnerability in a single model by forcing it to learn robust features. The process is hard, often requires models with large capacity, and suffers from significant loss on clean data accuracy. Alternatively, ensemble methods are proposed to induce sub-models with diverse outputs against a transfer adversarial example, making the ensemble robust against transfer attacks even if each sub-model is individually non-robust. Only small clean accuracy drop is observed in the process. However, previous ensemble training methods are not efficacious in inducing such diversity and thus ineffective on reaching robust ensemble. We propose DVERGE, which isolates the adversarial vulnerability in each sub-model by distilling non-robust features, and diversifies the adversarial vulnerability to induce diverse outputs against a transfer attack. The novel diversity metric and training procedure enables DVERGE to achieve higher robustness against transfer attacks comparing to previous ensemble methods, and enables the improved robustness when more sub-models are added to the ensemble. The code of this work is available at https://github.com/zjysteven/DVERGE

arXiv commentTo be appeared in NeurIPS 2020 conference (Oral)

References in corpus (16)

• Adam: A Method for Stochastic Optimization
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• On Evaluating Adversarial Robustness
• The Space of Transferable Adversarial Examples
• Robustness May Be at Odds with Accuracy
• Improving Adversarial Robustness via Promoting Ensemble Diversity
• Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Convergent Learning: Do different neural networks learn the same representations?
• On Adaptive Attacks to Adversarial Example Defenses
• Improving Adversarial Robustness of Ensembles with Diversity Training
• Efficient and Scalable Bayesian Neural Nets with Rank-1 Factors
• Training Ensembles to Detect Adversarial Examples
• Transferable Perturbations of Deep Feature Distributions
• Diversity inducing Information Bottleneck in Model Ensembles

Cited by in corpus (15)

• A Review of Uncertainty Quantification in Deep Learning: Techniques, Applications and Challenges
• Mutual Adversarial Training: Learning together is better than going alone
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• On the Certified Robustness for Ensemble Models and Beyond
• TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
• Random Noise Defense Against Query-Based Black-Box Attacks
• Robustness via Cross-Domain Ensembles
• Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness
• Push Stricter to Decide Better: A Class-Conditional Feature Adaptive Framework for Improving Adversarial Robustness
• Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations
• Domain Invariant Adversarial Learning
• Adaptive Perturbation for Adversarial Attack
• Greedy Bayesian Posterior Approximation with Deep Ensembles
• CoG: a Two-View Co-training Framework for Defending Adversarial Attacks on Graph
• Towards Comprehensive Monocular Depth Estimation: Multiple Heads Are Better Than One