Formulating Robustness Against Unforeseen Attacks

Dai, Sihui; Mahloujifar, Saeed; Mittal, Prateek

doi:10.48550/arxiv.2204.13779

Cited by 1 publication

(8 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From Figure 1a, we find that some existing defenses achieve both high clean accuracy and high CR ind-avg . Interestingly, we find that the 2 best models in terms of CR ind-avg Overall, we find that CR ind-avg are uncorrelated; for example, the rank 4, 5, and 6 models in terms of CR ind-avg (models using LPIPS threat model (Laidlaw et al, 2021;Dai et al, 2022) and no knowledge (Jin & Rinard, 2020)) have the lowest clean accuracies out of all defenses present on the leaderboard.…”

Section: Evaluating Existing Techniques For Robustness Against Multip...mentioning

confidence: 60%

“…One line of works focuses on improving robustness against the union of known attacks (typically the union of p -balls) (Maini et al, 2020;Tramèr & Boneh, 2019;Croce & Hein, 2020a;Madaan et al, 2020). Another line of works looks at defending against attacks that are not used during training (Laidlaw et al, 2021;Dai et al, 2022;Jin & Rinard, 2020). We provide a framework that unifies both of these research directions and provides metrics and a leaderboard for benchmarking these defenses.…”

Section: Prior Workmentioning

confidence: 99%

“…While prior works have studied problems relating to robustness against multiple attacks (Tramèr & Boneh, 2019;Maini et al, 2020;Croce & Hein, 2020a;Laidlaw et al, 2021;Dai et al, 2022;Jin & Rinard, 2020;Hsiung et al, 2022a), these works have studied specific instances of multiattack robustness (i.e. robustness against unions of known threat models, unforeseen attack robustness), but have not provided a unified framework for modelling problems in multiattack robustness.…”

Section: A Unified Adversarial Game Framework For Modeling Robustness...mentioning

confidence: 99%

“…We provide 2 leaderboards for the CIFAR-10 dataset, one for average case performance, which ranks defenses based on CR ind-avg , and one for worst case performance, which ranks defenses based on CR ind-worst . Our leaderboard contains evaluations for 16 pretrained models, all of which use training-based defenses, including techniques for training on unions of p norms (Maini et al, 2020;Tramèr & Boneh, 2019;Madaan et al, 2020), training with novel threat models (Laidlaw et al, 2021), regularization based approaches (Jin & Rinard, 2020;Dai et al, 2022), and p norm adversarial training (Madry et al, 2018;Zhang et al, 2019;Rebuffi et al, 2021). We include details of the models present on the leaderboard in Appendix D. We note that these models are trained with either 2 attacks with = 0.5, ∞ attacks with = 8 255 , LPIPS attacks with = 1, or the union of 1 , = 2000 255 , 2 , = 128 255 and ∞ , = 8 255 attacks.…”

Section: Leaderboardmentioning

confidence: 99%

“…These test-time adversaries can potentially use multiple (and unforeseen) attack types, motivating the need to study multiattack robustness. Several works (Maini et al, 2020;Tramèr & Boneh, 2019;Croce & Hein, 2020a;Dai et al, 2022;Jin & Rinard, 2020;Laidlaw et al, 2021;Hsi-Preprint. Under review.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Parameterizing Activation Functions for Adversarial Robustness

Dai

Mahloujifar

Mittal

2022

2022 IEEE Security and Privacy Workshops (SPW)

View full text Add to dashboard Cite

The bulk of existing research in defending against adversarial examples focuses on defending against a single (typically bounded p -norm) attack, but for a practical setting, machine learning (ML) models should be robust to a wide variety of attacks. In this paper, we present the first unified framework for considering multiple attacks against ML models. Our framework is able to model different levels of learner's knowledge about the test-time adversary, allowing us to model robustness against unforeseen attacks and robustness against unions of attacks. Using our framework, we present the first leaderboard, MultiRobustBench, for benchmarking multiattack evaluation which captures performance across attack types and attack strengths. We evaluate the performance of 16 defended models for robustness against a set of 9 different attack types, including p -based threat models, spatial transformations, and color changes, at 20 different attack strengths (180 attacks total). Additionally, we analyze the state of current defenses against multiple attacks. Our analysis shows that while existing defenses have made progress in terms of average robustness across the set of attacks used, robustness against the worst-case attack is still a big open problem as all existing models perform worse than random guessing.

show abstract

Section: Evaluating Existing Techniques For Robustness Against Multip...mentioning

confidence: 60%

Section: Prior Workmentioning

confidence: 99%