Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness
arXiv:2110.08256
Abstract
The vulnerability of deep neural networks to adversarial examples has motivated an increasing number of defense strategies for promoting model robustness. However, the progress is usually hampered by insufficient robustness evaluations. As the de facto standard to evaluate adversarial robustness, adversarial attacks typically solve an optimization problem of crafting adversarial examples with an iterative process. In this work, we propose a Model-Agnostic Meta-Attack (MAMA) approach to discover stronger attack algorithms automatically. Our method learns the optimizer in adversarial attacks parameterized by a recurrent neural network, which is trained over a class of data samples and defenses to produce effective update directions during adversarial example generation. Furthermore, we develop a model-agnostic training algorithm to improve the generalization ability of the learned optimizer when attacking unseen defenses. Our approach can be flexibly incorporated with various attacks and consistently improves the performance with little extra computational cost. Extensive experiments demonstrate the effectiveness of the learned attacks by MAMA compared to the state-of-the-art attacks on different defenses, leading to a more reliable evaluation of adversarial robustness.
References in corpus (20)
- Model-Agnostic Meta-Learning for Fast Adaptation of Deep Networks
- Estimating or Propagating Gradients Through Stochastic Neurons for Conditional Computation
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- On Evaluating Adversarial Robustness
- Fast is better than free: Revisiting adversarial training
- Using Pre-Training Can Improve Model Robustness and Uncertainty
- Adversarial Transformation Networks: Learning to Generate Adversarial Examples
- Improving Adversarial Robustness via Promoting Ensemble Diversity
- Learning to Learn without Gradient Descent by Gradient Descent
- Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
- Learned Optimizers that Scale and Generalize
- Self-Adaptive Training: beyond Empirical Risk Minimization
- Adversarially Robust Generalization Just Requires More Unlabeled Data
- You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
- Metric Learning for Adversarial Robustness
- An Alternative Surrogate Loss for PGD-based Adversarial Testing
- Query-efficient Meta Attack to Deep Neural Networks
- Adversarial Distributional Training for Robust Deep Learning
- Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defenses
- Training Stronger Baselines for Learning to Optimize