Jacobian Regularization for Mitigating Universal Adversarial Perturbations

Abstract

Universal Adversarial Perturbations (UAPs) are input perturbations that can fool a neural network on large sets of data. They are a class of attacks that represents a significant threat as they facilitate realistic, practical, and low-cost attacks on neural networks. In this work, we derive upper bounds for the effectiveness of UAPs based on norms of data-dependent Jacobians. We empirically verify that Jacobian regularization greatly increases model robustness to UAPs by up to four times whilst maintaining clean performance. Our theoretical analysis also allows us to formulate a metric for the strength of shared adversarial perturbations between pairs of inputs. We apply this metric to benchmark datasets and show that it is highly correlated with the actual observed robustness. This suggests that realistic and practical universal attacks can be reliably mitigated without sacrificing clean accuracy, which shows promise for the robustness of machine learning systems.

arXiv commentIn Proceedings of the 30th International Conference on Artificial Neural Networks (ICANN 2021), related code available at: https://github.com/kenny-co/sgd-uap-torch

References in corpus (14)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Intriguing properties of neural networks
• Evasion Attacks against Machine Learning at Test Time
• Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving
• Sensitivity and Generalization in Neural Networks: an Empirical Study
• Robust Large Margin Deep Neural Networks
• Adversarial Patch
• Physical Adversarial Examples for Object Detectors
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks
• AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning
• Robust Learning with Jacobian Regularization
• Adversarial Training is a Form of Data-dependent Operator Norm Regularization
• Sensitivity of Deep Convolutional Networks to Gabor Noise

Cited by in corpus (3)

• Universal Adversarial Robustness of Texture and Shape-Biased Models
• Towards an Awareness of Time Series Anomaly Detection Models' Adversarial Vulnerability
• Real-time Detection of Practical Universal Adversarial Perturbations