ATRAS: Adversarially Trained Robust Architecture Search

Abstract

In this paper, we explore the effect of architecture completeness on adversarial robustness. We train models with different architectures on CIFAR-10 and MNIST dataset. For each model, we vary different number of layers and different number of nodes in the layer. For every architecture candidate, we use Fast Gradient Sign Method (FGSM) to generate untargeted adversarial attacks and use adversarial training to defend against those attacks. For each architecture candidate, we report pre-attack, post-attack and post-defense accuracy for the model as well as the architecture parameters and the impact of completeness to the model accuracies.

arXiv comment9 pages, 2 figures, 2 tables

References in corpus (5)

• Explaining and Harnessing Adversarial Examples
• On the Convergence and Robustness of Adversarial Training
• Adversarial Attacks on Convolutional Neural Networks in Facial Recognition Domain
• Adversarial Attacks against Neural Networks in Audio Domain: Exploiting Principal Components
• Perfecting the Crime Machine