Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training

Abstract

Recent improvements in deep learning models and their practical applications have raised concerns about the robustness of these models against adversarial examples. Adversarial training (AT) has been shown effective to reach a robust model against the attack that is used during training. However, it usually fails against other attacks, i.e. the model overfits to the training attack scheme. In this paper, we propose a simple modification to the AT that mitigates the mentioned issue. More specifically, we minimize the perturbation ${\ell }_p$ norm while maximizing the classification loss in the Lagrangian form. We argue that crafting adversarial examples based on this scheme results in enhanced attack generalization in the learned model. We compare our final model robust accuracy against attacks that were not used during training to closely related state-of-the-art AT methods. This comparison demonstrates that our average robust accuracy against unseen attacks is 5.9% higher in the CIFAR-10 dataset and is 3.2% higher in the ImageNet-100 dataset than corresponding state-of-the-art methods. We also demonstrate that our attack is faster than other attack schemes that are designed for unseen attack generalization, and conclude that it is feasible for large-scale datasets.

References in corpus (18)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Deep Face Recognition: A Survey
• The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
• Synthesizing Robust Adversarial Examples
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Adversarial Examples Are Not Bugs, They Are Features
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Robustness May Be at Odds with Accuracy
• Spatially Transformed Adversarial Examples
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Adversarial Training and Robustness for Multiple Perturbations
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Functional Adversarial Attacks
• Testing Robustness Against Unforeseen Adversaries
• Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
• Understanding and Improving Fast Adversarial Training
• E-LPIPS: Robust Perceptual Image Similarity via Random Transformation Ensembles
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models