Domain Invariant Adversarial Learning
arXiv:2104.00322
Abstract
The phenomenon of adversarial examples illustrates one of the most basic vulnerabilities of deep neural networks. Among the variety of techniques introduced to surmount this inherent weakness, adversarial training has emerged as the most effective strategy for learning robust models. Typically, this is achieved by balancing robust and natural objectives. In this work, we aim to further optimize the trade-off between robust and standard accuracy by enforcing a domain-invariant feature representation. We present a new adversarial training method, Domain Invariant Adversarial Learning (DIAL), which learns a feature representation that is both robust and domain invariant. DIAL uses a variant of Domain Adversarial Neural Network (DANN) on the natural domain and its corresponding adversarial domain. In the case where the source domain consists of natural examples and the target domain is the adversarially perturbed examples, our method learns a feature representation constrained not to discriminate between the natural and adversarial examples, and can therefore achieve a more robust representation. DIAL is a generic and modular technique that can be easily incorporated into any adversarial training method. Our experiments indicate that incorporating DIAL in the adversarial training process improves both robustness and standard accuracy.
References in corpus (39)
- Wide Residual Networks
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Theoretically Principled Trade-off between Robustness and Accuracy
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Certified Adversarial Robustness via Randomized Smoothing
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
- Certified Defenses against Adversarial Examples
- Adversarially Robust Generalization Requires More Data
- Fast is better than free: Revisiting adversarial training
- Robustness May Be at Odds with Accuracy
- Certifying Some Distributional Robustness with Principled Adversarial Training
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Spatially Transformed Adversarial Examples
- Improving Adversarial Robustness via Promoting Ensemble Diversity
- Semidefinite relaxations for certifying robustness to adversarial examples
- On the Convergence and Robustness of Adversarial Training
- Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
- Are Labels Required for Improving Adversarial Robustness?
- Motivating the Rules of the Game for Adversarial Example Research
- Scaling provable adversarial defenses
- Rademacher Complexity for Adversarially Robust Generalization
- Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
- Improving the Generalization of Adversarial Training with Domain Adaptation
- Adversarially Robust Generalization Just Requires More Unlabeled Data
- Unrestricted Adversarial Examples
- Unlabeled Data Improves Adversarial Robustness
- DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
- VC Classes are Adversarially Robustly Learnable, but Only Improperly
- Recent Advances in Adversarial Training for Adversarial Robustness
- Curriculum Adversarial Training
- ADef: an Iterative Algorithm to Construct Adversarial Deformations
- Adversarial Risk Bounds via Function Transformation
- Interpreting Adversarial Robustness: A View from Decision Surface in Input Space
- Intriguing properties of adversarial training at scale
- Bag of Tricks for Adversarial Training
- Understanding Adversarial Robustness Through Loss Landscape Geometries
- Formalizing Generalization and Robustness of Neural Networks to Weight Perturbations
- Towards Defending Multiple -norm Bounded Adversarial Perturbations via Gated Batch Normalization
- On the Rademacher Complexity of Linear Hypothesis Sets