Ensemble Noise Simulation to Handle Uncertainty about Gradient-based Adversarial Attacks

Abstract

Gradient-based adversarial attacks on neural networks can be crafted in a variety of ways by varying either how the attack algorithm relies on the gradient, the network architecture used for crafting the attack, or both. Most recent work has focused on defending classifiers in a case where there is no uncertainty about the attacker's behavior (i.e., the attacker is expected to generate a specific attack using a specific network architecture). However, if the attacker is not guaranteed to behave in a certain way, the literature lacks methods in devising a strategic defense. We fill this gap by simulating the attacker's noisy perturbation using a variety of attack algorithms based on gradients of various classifiers. We perform our analysis using a pre-processing Denoising Autoencoder (DAE) defense that is trained with the simulated noise. We demonstrate significant improvements in post-attack accuracy, using our proposed ensemble-trained defense, compared to a situation where no effort is made to handle uncertainty.

Adversarial Training with Stochastic Weight Average

“…Though many researches that connect ensemble and adversarial robustness have proposed, only few surpass adversarial training (Madry et al 2017) in white-box condition. Majority of these researches more focus on transferability (Kariyappa and Qureshi 2019;Truex et al 2019;Mahfuz, Sahay, and Gamal 2020;Chow et al 2019), ensuring theoretic certifications (Lecuyer et al 2019;Cohen, Rosenfeld, and Kolter 2019) or finding alternative solution beside PGD-AT (Pang et al 2019;Liu et al 2018;Abbasi et al 2020;Strauss et al 2017).…”