This paper explores adversarial training limits and improves model robustness against norm-bounded perturbations.
problem Understanding and improving adversarial robustness of deep neural networks.
method Systematic study of adversarial training with various factors, including model size, activation functions, and unlabeled data.
result Training robust models that go beyond state-of-the-art results by combining larger models, Swish/SiLU activations, and model weight averaging.
This paper shows excessive invariance in adversarial robust models can make them more vulnerable to certain types of attacks.
problem Excessive invariance in adversarial robust models can make them more vulnerable to certain types of attacks.
method Analytical constructions and empirical studies of vision classifiers with state-of-the-art robustness to perturbation-based adversaries constrained by an ℓp norm. result Robustness to perturbation-based adversarial examples does not guarantee general robustness and can increase vulnerability to invariance-based adversarial examples.
Adversarial examples are typically constructed by perturbing an existing data point within a small matrix norm, and current defense methods are focused on guarding against this type of attack. In this paper, we propose unrestricted adversarial examples, a new threat model where the attackers are not restricted to small…
Free adversarial training reduces the generalization gap compared to vanilla method.
problem Improving generalization in adversarial training.
method Analysis of algorithmic stability in free adversarial training.
result Free adversarial training shows a lower generalization gap.
Guarantees recovery of compressible signals from adversarial noise.
problem Recovering compressible signals from noise and adversarial attacks.
method Extends adversarial defense framework to ℓ0, ℓ2, and ℓ∞ norms. result Recovery guarantees for various signal recovery methods under different noise types.
Several recent works have developed methods for training classifiers that are certifiably robust against norm-bounded adversarial perturbations. These methods assume that all the adversarial transformations are equally important, which is seldom the case in real-world applications. We advocate for cost-sensitive robust…
Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set…
Open-world evasion attacks using OOD adversarial examples outperform in-distribution attacks.
problem Evasion attacks on deep learning systems in open-world environments.
method Using 11 neural network models trained on 3 datasets, the study demonstrates the effectiveness of OOD adversarial examples against state-of-the-art detectors and defenses.
result OOD adversarial examples can achieve up to 4x higher success rates than in-distribution adversarial examples against known defenses.
New defense method inspired by encryption improves visual classification accuracy.
problem Conventional defenses reduce accuracy and are defeated by obfuscated gradients.
method Block-wise pixel shuffling with secret key for training and test images.
result Achieves high accuracy (91.55%) on clean images and (89.66%) on adversarial examples.
Generative models improve adversarial robustness by adding synthetic data.
problem Improving robustness in machine learning models trained on limited data.
method Using synthetic data generated from a large dataset to augment the original training set.
result Generative models can significantly reduce the robust-accuracy gap compared to models trained with additional real data.
A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by ℓp norm-bounded perturbations. In this paper, we propose a new threat model for adver…
Data augmentation improves robustness in adversarial training.
problem Adversarial training robust overfitting.
method Common data augmentation schemes combined with model weight averaging.
result Significant boost in robust accuracy, up to +2.93%.
New method makes deep nets more robust to attacks without increasing training time.
problem Gradient obfuscation makes models vulnerable to stronger attacks.
method Local linearization regularizer to penalize non-linearity in loss surface.
result Models trained with regularizer achieve 47% adversarial accuracy on ImageNet.
The paper uses optimal transport to find the minimum loss in adversarial classification.
problem Understanding the robustness of machine learning classifiers to adversarial attacks.
method Optimal transport to characterize minimum possible loss in adversarial classification scenarios.
result The minimum transportation cost between class distributions provides a lower bound on classification performance.
New approach to adversarial robustness with non-uniform perturbations.
problem Real-world adversaries craft adversarial examples with non-uniform perturbations.
method Proposes non-uniform perturbations based on feature dependencies and data distribution.
result Shows improved robustness to real-world attacks compared to uniform perturbations.
AMP regularization improves deep learning models by favoring flat minima.
problem Improving deep learning model generalization and avoiding overfitting.
method AMP regularization uses adversarial model perturbation to minimize a norm-bounded perturbation of the empirical risk.
result AMP regularization leads to state-of-the-art performance across various deep architectures.
Making neural networks robust against adversarial inputs has resulted in an arms race between new defenses and attacks. The most promising defenses, adversarially robust training and verifiably robust training, have limitations that restrict their practical applications. The adversarially robust training only makes the…
RS-Del provides robustness for sequence classifiers against edit distance attacks.
problem Certifying robustness of discrete sequence classifiers against edit distance attacks.
method Randomized deletion (RS-Del) for discrete sequence classifiers, focusing on edit distance-bounded adversaries.
result Achieved a certified accuracy of 91% at an edit distance radius of 128 bytes on malware detection.
New regularizers tighten convex relaxation bounds for neural networks.
problem Large gap between certifiable and empirical robustness in neural networks.
method Two regularizers to train neural networks yielding tighter convex relaxation bounds.
result Higher certified accuracy with proposed regularizers.
Many state-of-the-art machine learning models such as deep neural networks have recently shown to be vulnerable to adversarial perturbations, especially in classification tasks. Motivated by adversarial machine learning, in this paper we investigate the robustness of sparse regression models with strongly correlated co…
Paper analyzes adversarial training's performance in binary classification.
problem Understanding the generalization performance of adversarial training.
method Derives precise theoretical predictions for adversarial training performance.
result Provides exact asymptotics for test errors of adversarial training.
Paper defends machine learning models from adversarial attacks using GLRT.
problem Adversarial attacks on machine learning models leading to misclassification.
method Generalized likelihood ratio test (GLRT) for robust classification.
result GLRT yields performance competitive with minimax approach under worst-case attacks, and better trade-off under weaker attacks.
New method defends deep nets against large perturbations perceptible to humans.
problem Vulnerability of deep nets to adversarial attacks with perceptible but not changing predictions.
method Oracle-Aligned Adversarial Training (OA-AT) to align network predictions with Oracle's.
result Achieves state-of-the-art performance at large perturbation bounds (L-inf of 16/255 on CIFAR-10).
Paper proposes a method to improve deep learning models' robustness to real-world variations.
problem Deep learning models fail to generalize to small variations of the input.
method Adversarial mixing with disentangled representations to enforce robustness to real-world transformations.
result Improves generalization and reduces spurious correlations, as shown by experiments.
RADIAL-RL improves deep RL agents' robustness against adversarial attacks.
problem Vulnerability of deep reinforcement learning agents to small adversarial perturbations.
method RADIAL-RL, a principled framework for training robust reinforcement learning agents.
result RADIAL-RL-trained agents consistently outperform prior methods in robustness tests.
The paper improves confidence regions for band-limited functions using tighter norm bounds and majority voting.
problem Constructing reliable confidence regions for band-limited functions from noisy data.
method Improved norm bounds using Hoeffding's inequality and empirical Bernstein bound, majority voting to aggregate intervals.
result Confidence intervals retain their simultaneous coverage guarantee even when aggregated from random subsamples.
Proposes model-based robust deep learning to handle natural variation in data.
problem Deep learning's fragility to natural variation in data.
method Develops model-based robust training algorithms using deep generative models to learn natural variation.
result Deep neural networks trained with model-based algorithms outperform standard and norm-bounded robust algorithms.
Recent work has developed methods for learning deep network classifiers that are provably robust to norm-bounded adversarial perturbation; however, these methods are currently only possible for relatively small feedforward networks. In this paper, in an effort to scale these approaches to substantially larger models, w…
Study examines uncertainty in adversarially trained models and proposes improved AT methods.
problem Uncertainty quantification in adversarially trained models for safety-critical applications.
method Investigates conformal prediction (CP) for adversarial attacks, proposes Beta-weighting loss with entropy minimization for improved prediction set size (PSS).
result Proposed AT-UR method improves CP efficiency and prediction set size.
Paper introduces MultiTargeted testing, improving adversarial testing efficiency.
problem Improving efficiency and effectiveness of adversarial testing methods.
method Introduces MultiTargeted testing, using alternative surrogate losses.
result MultiTargeted outperforms other PGD-based methods, requiring fewer iterations.
Paper certifies neural network control policies against persistent adversarial perturbations.
problem Neural networks' fragility to adversarial perturbations in control systems.
method Combining neural network certification tools with robust control theory.
result Certifies neural network policies in a control loop under l-infinity norm bounded adversarial perturbations.
New method improves robustness of smoothed classifiers.
problem Improving accuracy and robustness of smoothed classifiers.
method Regularized risk with adaptive regularization.
result Tighter robustness bounds with high probability.
New method creates universal perturbations to fool neural network interpretations.
problem Vulnerability of gradient-based saliency maps to adversarial perturbations.
method Gradient-based optimization and PCA-based approach to create UPI.
result Existence and successful application of Universal Perturbation for Interpretation (UPI).
New method enforces orthogonality in convolutional layers for improved robustness.
problem Improving adversarial robustness in deep learning models.
method Applying the Cayley transform to skew-symmetric convolutions in the Fourier domain.
result The proposed method preserves orthogonality and enhances adversarial robustness compared to existing techniques.
Develops GLRT for defending against adversarial attacks in hypothesis testing.
problem Adversarial attacks on machine learning models causing misclassification.
method Generalized likelihood ratio test applied to composite hypothesis testing problem.
result GLRT approach yields competitive robustness-accuracy tradeoff under various attacks.
Enhances robustness of AT frameworks to multiple perturbations without increasing training complexity.
problem Defending against the union of multiple perturbations in adversarial training.
method SNAP technique that augments a network with shaped noise to enhance robustness.
result 14%-to-20% improvement in adversarial accuracy for ResNet-18 on CIFAR-10.
Efficiently trains robust models with faster and more stable interval bounds.
problem Training verifiably robust models against adversarial attacks.
method Integrates interval arithmetic and an additional cost function term to keep hidden layer bounds small.
result Comparable or better results achieved with fewer training iterations and more stability.
Recent work has shown that it is possible to train deep neural networks that are provably robust to norm-bounded adversarial perturbations. Most of these methods are based on minimizing an upper bound on the worst-case loss over all possible adversarial perturbations. While these techniques show promise, they often res…
New IDS algorithm refines parameter norm bounds for better bandit performance.
problem Frequentist IDS requires tight norm bounds, which are often unavailable in practice.
method Iteratively refines a high-probability upper bound on true parameter norm using data.
result Regret bounds independent of assumed parameter norm, outperforming state-of-the-art algorithms.
Neural networks classify OOD images by their nearest neighbor in training data.
problem Understanding out-of-distribution prediction behavior of neural networks.
method Nearest category generalization (NCG) measure to assess OOD prediction accuracy.
result Adversarially robust networks have higher NCG accuracy than natural training, indicating local regularization impacts decision regions.
Efficiently computes per-example gradients in CNNs for differential privacy.
problem Computing per-example gradients in CNNs for differential privacy.
method Comparison of existing strategies and introduction of a new per-example gradient calculation method.
result The new method is advantageous depending on model architecture and training.
Proposes ETB for tighter bounds in robust training of deep networks.
problem Training robust deep neural networks to adversarial attacks.
method Proposes ETB, a provably tighter bound approach for interval bound propagation.
result Achieves orders of magnitudes tighter bounds compared to IBP.
In this note, we derive concentration inequalities for random vectors with subGaussian norm (a generalization of both subGaussian random vectors and norm bounded random vectors), which are tight up to logarithmic factors.
New approach to certifiably robust neural networks using Boolean function perspective.
problem Lack of principled understanding and certified robustness for ℓ∞ perturbations. method New perspective on Boolean functions, deriving impossibility results, and developing a unified Lipschitz network.
result Unified Lipschitz network that bypasses expressive power limitations and achieves better certified robustness.
Method identifies over-optimized adversarial examples using IQR-based logit thresholding.
problem Over-optimized adversarial examples are hard to detect due to model optimization.
method IQR-based logit thresholding method for identifying over-optimized adversarial examples.
result The logits of the model are more useful in detecting over-optimized adversarial examples.
Linear classifiers can be made robust to strong adversarial examples attacks.
problem Understanding and quantifying adversarial examples in linear classification.
method Proposed a more practical definition of strong adversarial examples, showing robustness to attacks.
result Linear classifiers can be made robust to strong adversarial examples attacks.
With rapid progress and significant successes in a wide spectrum of applications, deep learning is being applied in many safety-critical environments. However, deep neural networks have been recently found vulnerable to well-designed input samples, called adversarial examples. Adversarial examples are imperceptible to …
Uniform convergence of interpolators proven for Gaussian data.
problem Interpolation learning in high-dimensional linear regression with Gaussian data.
method Generic uniform convergence guarantee in terms of Gaussian width.
result Consistency of interpolators for minimum-norm and near-minimal-norm cases.