A Multiclass Boosting Framework for Achieving Fast and Provable Adversarial Robustness
arXiv:2103.01276
Abstract
Alongside the well-publicized accomplishments of deep neural networks there has emerged an apparent bug in their success on tasks such as object recognition: with deep models trained using vanilla methods, input images can be slightly corrupted in order to modify output predictions, even when these corruptions are practically invisible. This apparent lack of robustness has led researchers to propose methods that can help to prevent an adversary from having such capabilities. The state-of-the-art approaches have incorporated the robustness requirement into the loss function, and the training process involves taking stochastic gradient descent steps not using original inputs but on adversarially-corrupted ones. In this paper we propose a multiclass boosting framework to ensure adversarial robustness. Boosting algorithms are generally well-suited for adversarial scenarios, as they were classically designed to satisfy a minimax guarantee. We provide a theoretical foundation for this methodology and describe conditions under which robustness can be achieved given a weak training oracle. We show empirically that adversarially-robust multiclass boosting not only outperforms the state-of-the-art methods, it does so at a fraction of the training time.
arXiv commentFixed misspelled first author name
References in corpus (16)
- Distilling the Knowledge in a Neural Network
- SGDR: Stochastic Gradient Descent with Warm Restarts
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Theoretically Principled Trade-off between Robustness and Accuracy
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Adversarial Robustness via Randomized Smoothing
- Certified Defenses against Adversarial Examples
- Certifying Some Distributional Robustness with Principled Adversarial Training
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Towards the first adversarially robust neural network model on MNIST
- Certified Adversarial Robustness with Additive Noise
- Motivating the Rules of the Game for Adversarial Example Research
- Attacking the Madry Defense Model with -based Adversarial Examples
- An Alternative Surrogate Loss for PGD-based Adversarial Testing
- On Robustness to Adversarial Examples and Polynomial Optimization
- Reducing Adversarially Robust Learning to Non-Robust PAC Learning