Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks

Abstract

Adversarial Training is proved to be an efficient method to defend against adversarial examples, being one of the few defenses that withstand strong attacks. However, traditional defense mechanisms assume a uniform attack over the examples according to the underlying data distribution, which is apparently unrealistic as the attacker could choose to focus on more vulnerable examples. We present a weighted minimax risk optimization that defends against non-uniform attacks, achieving robustness against adversarial examples under perturbed test data distributions. Our modified risk considers importance weights of different adversarial examples and focuses adaptively on harder examples that are wrongly classified or at higher risk of being classified incorrectly. The designed risk allows the training process to learn a strong defense through optimizing the importance weights. The experiments show that our model significantly improves state-of-the-art adversarial accuracy under non-uniform attacks without a significant drop under uniform attacks.

References in corpus (15)

• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Theoretically Principled Trade-off between Robustness and Accuracy
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• FreeLB: Enhanced Adversarial Training for Natural Language Understanding
• Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradients
• Adversarial Robustness through Local Linearization
• Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Label Smoothing and Logit Squeezing: A Replacement for Adversarial Training?
• Defending against Whitebox Adversarial Attacks via Randomized Discretization
• Doubly Robust Data-Driven Distributionally Robust Optimization

Cited by in corpus (2)

• Learnability and Robustness of Shallow Neural Networks Learned With a Performance-Driven BP and a Variant PSO For Edge Decision-Making
• Certified Defense via Latent Space Randomized Smoothing with Orthogonal Encoders