Robust Learning with Jacobian Regularization

Hoffman, Judy; Roberts, Daniel A.; Yaida, Sho

doi:10.48550/arxiv.1908.02729

Cited by 33 publications

(78 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These are widely-used image classification datasets, each with 10 classes, whose images are 28 by 28 pixels, and their pixel values range from 0 to 1. For the neural network architecture, we use a modernized version of LeNet-5 [17] as detailed in [12] as it is a commonly used benchmark neural network. We refer to this model as LeNet.…”

Section: Methodsmentioning

confidence: 99%

“…To improve the stability of model outputs to small perturbations δ, existing works have proposed regularizing the Frobenius norm [12,13,20] or the Spectral norm [22,24,29] of this data-dependent Jacobian J f (x) for each input. Additionally, [22] show that the input-specific adversarial perturbations align with the dominant singular vectors of these Jacobian matrices.…”

Section: Jacobian Regularizationmentioning

confidence: 99%

“…A number of studies have investigated the use of Jacobian regularization to improve the stability of model predictions to small changes to the input, but up to this point, studies have only considered input-specific perturbations [12,13,20,22,24,29]. In this work, we expand the theoretical formulation of Jacobian regularization to UAPs and derive upper bounds on the effectiveness of UAPs based on the properties of Jacobian matrices for individual inputs.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Jacobian Regularization for Mitigating Universal Adversarial Perturbations

Co,

Rego,

Lupu

2021

Preprint

View full text Add to dashboard Cite

Universal Adversarial Perturbations (UAPs) are input perturbations that can fool a neural network on large sets of data. They are a class of attacks that represents a significant threat as they facilitate realistic, practical, and low-cost attacks on neural networks. In this work, we derive upper bounds for the effectiveness of UAPs based on norms of data-dependent Jacobians. We empirically verify that Jacobian regularization greatly increases model robustness to UAPs by up to four times whilst maintaining clean performance. Our theoretical analysis also allows us to formulate a metric for the strength of shared adversarial perturbations between pairs of inputs. We apply this metric to benchmark datasets and show that it is highly correlated with the actual observed robustness. This suggests that realistic and practical universal attacks can be reliably mitigated without sacrificing clean accuracy, which shows promise for the robustness of machine learning systems.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Jacobian Regularizationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Jacobian Regularization for Mitigating Universal Adversarial Perturbations

Co,

Rego,

Lupu

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Subsequent works by [18,26,31,34,75,76] introduce different variants and extensions of mixup. Regularization is also intimately connected to robustness [17,32,48,49,61]. Adding to the list is NFM, a powerful regularization method that we propose to improve model robustness.…”

Section: Related Workmentioning

confidence: 99%

Noisy Feature Mixup

Lim¹,

Erichson²,

Utrera³

et al. 2021

Preprint

View full text Add to dashboard Cite

We introduce Noisy Feature Mixup (NFM), an inexpensive yet effective method for data augmentation that combines the best of interpolation based training and noise injection schemes. Rather than training with convex combinations of pairs of examples and their labels, we use noise-perturbed convex combinations of pairs of data points in both input and feature space. This method includes mixup and manifold mixup as special cases, but it has additional advantages, including better smoothing of decision boundaries and enabling improved model robustness. We provide theory to understand this as well as the implicit regularization effects of NFM. Our theory is supported by empirical results, demonstrating the advantage of NFM, as compared to mixup and manifold mixup. We show that residual networks and vision transformers trained with NFM have favorable trade-offs between predictive accuracy on clean data and robustness with respect to various types of data perturbation across a range of computer vision benchmark datasets.

show abstract

“…The Adversarial Robustness based Adaptive Label Smoothing (AR-AdaLS) proposed by Qin et al [2020] aims to improve the smoothness of adversarial robustness in order to solve the instability: by training the model to distinguish the training data of varied adversarial robustness and by giving different supervision to the training data, their methods promotes label smoothing [Szegedy et al, 2013] and leads to better calibration and stability. Jakubovitz and Giryes [2018] and Hoffman et al [2019] studied Jacobian regularization to regularize the training loss after the regular training, aiming to provide another way of enhancing robustness other than adversarial training. Mopuri et al [2018], inspired by the architecture of GANs, attempted to capture the distribution of adversarial perturbation; their method exhibited extraordinary fooling rates, variety, and cross model generalizability.…”

Section: Introductionmentioning

confidence: 99%

Improving Adversarial Robustness for Free with Snapshot Ensemble

Wang

2021

Preprint

View full text Add to dashboard Cite

Adversarial training, as one of the few certified defenses against adversarial attacks, can be quite complicated and time-consuming, while the results might not be robust enough. To address the issue of lack of robustness, ensemble methods were proposed, aiming to get the final output by weighting the selected results from repeatedly trained processes. It is proved to be very useful in achieving robust and accurate results, but the computational and memory costs are even higher. Snapshot ensemble, a new ensemble method that combines several local minima in a single training process to make the final prediction, was proposed recently, which reduces the time spent on training multiple networks and the memory to store the results. Based on the snapshot ensemble, we present a new method that is easier to implement: unlike original snapshot ensemble that seeks for local minima, our snapshot ensemble focuses on the last few iterations of a training and stores the sets of parameters from them. Our algorithm is much simpler but the results are no less accurate than the original ones: based on different hyperparameters and datasets, our snapshot ensemble has shown a 5% to 30% increase in accuracy when compared to the traditional adversarial training.

show abstract

Robust Learning with Jacobian Regularization

Cited by 33 publications

References 24 publications

Jacobian Regularization for Mitigating Universal Adversarial Perturbations

Jacobian Regularization for Mitigating Universal Adversarial Perturbations

Noisy Feature Mixup

Improving Adversarial Robustness for Free with Snapshot Ensemble

Contact Info

Product

Resources

About