Adversarial Visual Robustness by Causal Intervention
arXiv:2106.09534
Abstract
Adversarial training is the de facto most promising defense against adversarial examples. Yet, its passive nature inevitably prevents it from being immune to unknown attackers. To achieve a proactive defense, we need a more fundamental understanding of adversarial examples, beyond the popular bounded threat model. In this paper, we provide a causal viewpoint of adversarial vulnerability: the cause is the spurious correlation ubiquitously existing in learning, i.e., the confounding effect, where attackers are precisely exploiting these effects. Therefore, a fundamental solution for adversarial robustness is by causal intervention. As these visual confounders are imperceptible in general, we propose to use the instrumental variable that achieves causal intervention without the need for confounder observation. We term our robust training method as Causal intervention by instrumental Variable (CiiV). It's a causal regularization that 1) augments the image with multiple retinotopic centers and 2) encourages the model to learn causal features, rather than local confounding patterns, by favoring features linearly responding to spatial interpolations. Extensive experiments on a wide spectrum of attackers and settings applied in CIFAR-10, CIFAR-100, and mini-ImageNet demonstrate that CiiV is robust to adaptive attacks, including the recent AutoAttack. Besides, as a general causal regularization, it can be easily plugged into other methods to further boost the robustness.
Codes are available at the following Github project: https://github.com/KaihuaTang/CiiV-Adversarial-Robustness.pytorch
References in corpus (24)
- Intriguing properties of neural networks
- mixup: Beyond Empirical Risk Minimization
- Wide Residual Networks
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Synthesizing Robust Adversarial Examples
- Certified Adversarial Robustness via Randomized Smoothing
- On Evaluating Adversarial Robustness
- Fast is better than free: Revisiting adversarial training
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Robustness May Be at Odds with Accuracy
- Certifying Some Distributional Robustness with Principled Adversarial Training
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Towards the first adversarially robust neural network model on MNIST
- Houdini: Fooling Deep Structured Prediction Models
- Torchattacks: A PyTorch Repository for Adversarial Attacks
- Adversarial Examples for Semantic Segmentation and Object Detection
- Adversarial Spheres
- On Multi-Cause Causal Inference with Unobserved Confounding: Counterexamples, Impossibility, and Alternatives
- Generalization in anti-causal learning
- Stabilized Medical Image Attacks
- Learnable Boundary Guided Adversarial Training
- Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attack
- RAIN: A Simple Approach for Robust and Accurate Image Classification Networks
- Learning Under Adversarial and Interventional Shifts