Towards Deep Learning Models Resistant to Adversarial Attacks

Abstract

Recent work has demonstrated that neural networks are vulnerable to adversarial examples, i.e., inputs that are almost indistinguishable from natural data and yet classified incorrectly by the network. In fact, some of the latest findings suggest that the existence of adversarial attacks may be an inherent weakness of deep learning models. To address this problem, we study the adversarial robustness of neural networks through the lens of robust optimization. This approach provides us with a broad and unifying view on much of the prior work on this topic. Its principled nature also enables us to identify methods for both training and attacking neural networks that are reliable and, in a certain sense, universal. In particular, they specify a concrete security guarantee that would protect against any adversary. These methods let us train networks with significantly improved resistance to a wide range of adversarial attacks. They also suggest the notion of security against a first-order adversary as a natural and broad security guarantee. We believe that robustness against such well-defined classes of adversaries is an important stepping stone towards fully resistant deep learning models.

Efficient and Robust Classification for Sparse Attacks

“…Although truncation on its own is expected to increase a classifier's robustness, we suggest going farther and coupling our framework with adversarial training as originally proposed by [8]. In the Gaussian mixture setting considered in Section 4, we prove that the asymptotically optimal classifier requires truncation as well as an optimization step for finding the best weights that resemble adversarial training.…”

“…They were initially shown to be effective in causing classification errors throughout different machine learning models [5,6,7]. Following this, a lot of effort has been put into generating increasingly more complex attack models that can utilize a small amount of semantic-preserving modifications, while still being able to fool a classifier [8,9,10]. Typically, this is done by constraining the perturbations with an p -norm, where the most common settings use either ∞ [11,12,9,8,13,14,15], 2 [16,9,17,18,19], or 1 [20,21].…”

“…Following this, a lot of effort has been put into generating increasingly more complex attack models that can utilize a small amount of semantic-preserving modifications, while still being able to fool a classifier [8,9,10]. Typically, this is done by constraining the perturbations with an p -norm, where the most common settings use either ∞ [11,12,9,8,13,14,15], 2 [16,9,17,18,19], or 1 [20,21]. As of now, the state-of-the-art empirical defense against adversarial attacks is iteratively retraining with adversarial examples [8].…”

“…Typically, this is done by constraining the perturbations with an p -norm, where the most common settings use either ∞ [11,12,9,8,13,14,15], 2 [16,9,17,18,19], or 1 [20,21]. As of now, the state-of-the-art empirical defense against adversarial attacks is iteratively retraining with adversarial examples [8]. While adversarial retraining by itself can help improve robustness, we have seen a fundamental trade-off between robustness and clean accuracy, as well as a lack of generalization across different attacks [22,23,24,25,26].…”

Adversarial Examples for Good: Adversarial Examples Guided Imbalanced Learning

“…The projected gradient descent (PGD) [16] we adopted is the most common method for finding adversarial examples. Given x 0 ∈ X ,…”