ATRO: Adversarial Training with a Rejection Option

Abstract

This paper proposes a classification framework with a rejection option to mitigate the performance deterioration caused by adversarial examples. While recent machine learning algorithms achieve high prediction performance, they are empirically vulnerable to adversarial examples, which are slightly perturbed data samples that are wrongly classified. In real-world applications, adversarial attacks using such adversarial examples could cause serious problems. To this end, various methods are proposed to obtain a classifier that is robust against adversarial examples. Adversarial training is one of them, which trains a classifier to minimize the worst-case loss under adversarial attacks. In this paper, in order to acquire a more reliable classifier against adversarial attacks, we propose the method of Adversarial Training with a Rejection Option (ATRO). Applying the adversarial training objective to both a classifier and a rejection function simultaneously, classifiers trained by ATRO can choose to abstain from classification when it has insufficient confidence to classify a test data point. We examine the feasibility of the framework using the surrogate maximum hinge loss and establish a generalization bound for linear models. Furthermore, we empirically confirmed the effectiveness of ATRO using various models and real-world datasets.

References in corpus (22)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Deep Learning using Linear Support Vector Machines
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• On Evaluating Adversarial Robustness
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Learning with a Strong Adversary
• Defensive Distillation is Not Robust to Adversarial Examples
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Adversarial vulnerability for any classifier
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Rademacher Complexity for Adversarially Robust Generalization
• Testing Robustness Against Unforeseen Adversaries
• SelectiveNet: A Deep Neural Network with an Integrated Reject Option
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• On Robustness to Adversarial Examples and Polynomial Optimization
• Towards Robust ResNet: A Small Step but A Giant Leap
• On the Calibration of Multiclass Classification with Rejection

Cited by in corpus (1)

• Adversarial Consistency and the Uniqueness of the Adversarial Bayes Classifier