New methods show robustness and accuracy can coexist.
problem Inevitability of robustness-accuracy tradeoff in deep learning.
method Prove robustness and accuracy achievable through locally Lipschitz functions; explore combining dropout with robust training methods.
result Achieving robustness and accuracy requires methods imposing local Lipschitzness and deep learning generalization techniques.
New work shows limits of certifying neural network robustness.
problem Certified training improves robustness but decreases accuracy.
method Bayes error analysis to investigate robustness limits.
result Upper bound for certified robust accuracy established.
Paper explores tradeoff between standard and robust accuracy for latent models.
problem Tradeoff between standard accuracy and robust accuracy in adversarial training.
method Revisits adversarial training for latent models, considering Gaussian mixture and generalized linear models.
result Low-dimensional manifold structure mitigates the tradeoff between standard and robust accuracy.
Improves natural accuracy of deep learning models by combining robust predictions and features.
problem Maintaining natural accuracy while resisting adversarial attacks.
method Ensemble methods combining robust and standard models.
result Optimized natural accuracy through ensemble of robust models.
Deep neural networks have achieved impressive performance in many applications but their large number of parameters lead to significant computational and storage overheads. Several recent works attempt to mitigate these overheads by designing compact networks using pruning of connections. However, we observe that most …
SCORE resolves the robustness vs accuracy trade-off by redefining robust error.
problem The inherent trade-off between robustness and accuracy in adversarial training.
method SCORE defines local equivariance as the ideal robust behavior, leading to a new robust error metric.
result SCORE reconciles robustness and accuracy, improving model performance on RobustBench.
AAT separates robust and non-robust features without supervision.
problem Adversarial vulnerability and accuracy reduction in machine learning models.
method Adversarial Asymmetric Training (AAT) algorithm.
result Preserves accuracy and achieves better disentanglement than previous methods.
We introduce a new metric to evaluate corruption robustness of ML classifiers.
problem Evaluating corruption robustness of machine learning classifiers.
method We propose a test data augmentation method using minimal class separation distance to derive a robustness distance ε and a metric MSCR.
result The MSCR metric allows interpretable comparison of classifier robustness on different datasets.
New trade-off found between accuracy and adversarial robustness in regression.
problem Finding a balance between accuracy and robustness in regression models.
method Deriving a fundamental trade-off between standard and adversarial risk in regression with polynomial ridge functions.
result A necessary condition for achieving adversarial robustness without significant accuracy loss.
Calibrated ensembles improve both ID and OOD accuracy in distribution shift.
problem Desired balance between in-distribution and out-of-distribution accuracy.
method Ensemble standard and robust models, calibrating on ID data only.
result ID-calibrated ensembles outperform state-of-the-art methods on multiple datasets.
This work introduces adversarial sparsity to measure robustness beyond adversarial accuracy.
problem Evaluating robustness to adversarial attacks beyond just accuracy.
method Adversarial sparsity, which quantifies the difficulty of finding perturbations.
result Sparsity provides valuable insights into neural networks and suggests improvements in robustness.
Deploying machine learning systems in the real world requires both high accuracy on clean data and robustness to naturally occurring corruptions. While architectural advances have led to improved accuracy, building robust models remains challenging. Prior work has argued that there is an inherent trade-off between robu…
Adversarial training can lead to unfair accuracy disparities between different groups.
problem Adversarial training algorithms introduce unfair accuracy disparities between different groups of data.
method Propose a Fair-Robust-Learning (FRL) framework to mitigate unfairness in adversarial defenses.
result Empirical and theoretical validation of FRL's effectiveness in mitigating unfairness.
The paper examines how adversarial robustness affects accuracy disparity across different classes.
problem Understanding the impact of adversarial robustness on accuracy disparity across different classes.
method Linear classifiers under a Gaussian mixture model, decomposing the impact into inherent and imbalance effects.
result Adversarial robustness consistently degrades standard accuracy in balanced classes, but the class imbalance ratio plays a different role in accuracy disparity.
Proposes a new adversarial model to avoid accuracy vs. adversarial accuracy tradeoff.
problem Inherent tradeoff between accuracy and adversarial accuracy in existing adversarial robustness definitions.
method Introduces Voronoi-epsilon adversary that balances perturbation constraints.
result Voronoi-epsilon adversary avoids accuracy vs. adversarial accuracy tradeoff even with large ε. Enhances DNN robustness and accuracy with L2,∞ normalization.
problem Improving the robustness and accuracy of deep neural networks.
method Introducing L2,∞ normalization of weight matrices in DNNs with Relu activation. result Lower bound for robustness measure in terms of L2,∞ norm and upper bound for Rademacher complexity. Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Advers…
Data augmentation improves robustness in adversarial training.
problem Adversarial training robust overfitting.
method Common data augmentation schemes combined with model weight averaging.
result Significant boost in robust accuracy, up to +2.93%.
This work benchmarks and theorizes robust NAS under adversarial training.
problem Lack of benchmark evaluations and theoretical guarantees for robust NAS architectures under adversarial training.
method Released a comprehensive data set and established a generalization theory using the neural tangent kernel.
result Established a generalization theory for robust NAS architectures under adversarial training.
This paper proposes BAT to balance accuracy and robustness in adversarial training.
problem Balancing accuracy and robustness in adversarial training models.
method Blind adversarial training (BAT) uses a cutoff-scale strategy to adaptively estimate a nonuniform budget for AEs.
result BAT improves the overall robustness of adversarial training models.
LiST improves neural network robustness and calibration without manual tuning.
problem Developing robust and calibrated neural networks simultaneously.
method Lipschitz Scaling Training (LiST) that iteratively adjusts the global Lipschitz constant.
result LiST yields an out-of-the-box calibrated network with competitive accuracy and robustness.
Unhinged loss minimization fails to improve classifier accuracy for simple data.
problem Accuracy of classifiers minimizing the unhinged loss.
method Minimizing the unhinged loss function.
result Minimizing the unhinged loss yields classifiers with accuracy no better than random guessing for simple data.
Generative models improve adversarial robustness by adding synthetic data.
problem Improving robustness in machine learning models trained on limited data.
method Using synthetic data generated from a large dataset to augment the original training set.
result Generative models can significantly reduce the robust-accuracy gap compared to models trained with additional real data.
We show that there may exist an inherent tension between the goal of adversarial robustness and that of standard generalization. Specifically, training robust models may not only be more resource-consuming, but also lead to a reduction of standard accuracy. We demonstrate that this trade-off between the standard accura…
SAT improves adversarial training by smoothing the loss landscape through curriculum learning.
problem Adversarial training sacrifices clean accuracy for robustness and suffers from large generalization error.
method SAT uses curriculum learning to smooth the adversarial loss landscape, improving both clean and robust accuracy.
result SAT models improve clean and robust accuracy significantly compared to adversarial training and other baselines.
The paper analyzes adversarial training effects on classification accuracy.
problem Understanding adversarial training's impact on standard and robust accuracy.
method Derived precise statistical analysis for binary classification problems with Gaussian data.
result Theoretical explanation of standard and robust accuracy trends for adversarial training.
We demonstrate, theoretically and empirically, that adversarial robustness can significantly benefit from semisupervised learning. Theoretically, we revisit the simple Gaussian model of Schmidt et al. that shows a sample complexity gap between standard and robust classification. We prove that unlabeled data bridges thi…
Paper presents robust boosting methods for label noise.
problem Boosting methods degrade in noisy environments.
method Robust Minimax Boosting (RMBoost) with theoretical guarantees.
result RMBoost provides strong classification accuracy and robustness.
Enhances deep learning models to resist adversarial attacks.
problem Protecting deep learning models from adversarial examples.
method Combines two mechanisms: increased robustness at the cost of accuracy and improved accuracy without robustness guarantee.
result Combining mechanisms provides robustness against adversarial examples while maintaining accuracy.
SONet stabilizes ODE networks for robustness without adversarial training.
problem Improving adversarial robustness of neural networks without sacrificing natural accuracy.
method SONet uses skew-symmetric ODE blocks and DOPRI5 solver for robustness.
result SONet achieves comparable robustness to adversarial defense methods without trade-off.
The paper explores robustness in linear regression models under adversarial attacks.
problem The impact of test-time adversarial attacks on linear regression models.
method Quantitative estimates and phase transitions analysis.
result Precise characterization of tradeoffs between adversarial robustness and accuracy.
Adversarial robustness has become an important research topic given empirical demonstrations on the lack of robustness of deep neural networks. Unfortunately, recent theoretical results suggest that adversarial training induces a strict tradeoff between classification accuracy and adversarial robustness. In this paper,…
Enhances survival analysis predictions with a robust learning approach.
problem Improving robustness and accuracy in survival analysis predictions.
method Integrates Distributionally Robust Learning (DRL) into Cox regression using Wasserstein distance-based ambiguity set.
result Demonstrates superior performance in prediction accuracy and robustness compared to traditional methods.
Improves authorship attribution accuracy and robustness against adversarial attacks.
problem Vulnerability of authorship attribution approaches to adversarial attacks.
method Formulated a relational adversary threat model and presented a novel learning framework, normalize-and-predict (N&P).
result Improves accuracy on adversarial inputs by up to 70% and robust accuracy by 45%.
Adversarial training can hurt robust accuracy in small sample size scenarios.
problem Adversarial training improves test accuracy but may degrade robustness in limited data settings.
method Analyzes high-dimensional linear classification with noiseless observations, and observes perceptible attacks on image datasets.
result Adversarial training can negatively impact robust generalization in small sample size regimes.
Paper shows adversarial training can be fooled by new type of noise.
problem Adversarial training can be fooled by new types of noise.
method Designing ADVIN, a new type of inducing noise.
result ADVIN can degrade adversarial training robustness by 99.9%.
Deep neural networks bring in impressive accuracy in various applications, but the success often relies on the heavy network architecture. Taking well-trained heavy networks as teachers, classical teacher-student learning paradigm aims to learn a student network that is lightweight yet accurate. In this way, a portable…
In many real-world applications of Machine Learning it is of paramount importance not only to provide accurate predictions, but also to ensure certain levels of robustness. Adversarial Training is a training procedure aiming at providing models that are robust to worst-case perturbations around predefined points. Unfor…
New method makes robust estimators work without knowing corruption levels.
problem Robust estimation algorithms struggle with unknown corruption levels.
method Abstracted geometric puzzle solution to universal meta technique.
result Converts any robust estimator to work without corruption bounds.
Current techniques in machine learning are so far are unable to learn classifiers that are robust to adversarial perturbations. However, they are able to learn non-robust classifiers with very high accuracy, even in the presence of random perturbations. Towards explaining this gap, we highlight the hypothesis that $\te…
RATIO improves neural network robustness and explainability.
problem Neural networks' lack of robustness to adversarial changes and uncertainty on out-distribution samples.
method RATIO: Adversarial Training on In- and Out-distribution.
result RATIO leads to robust models with reliable confidence estimates on out-distribution samples.
While adversarial training can improve robust accuracy (against an adversary), it sometimes hurts standard accuracy (when there is no adversary). Previous work has studied this tradeoff between standard and robust accuracy, but only in the setting where no predictor performs well on both objectives in the infinite data…
This work precisely characterizes and improves the tradeoff between robustness and accuracy in linear regression.
problem Tradeoff between robustness and accuracy in adversarial training.
method Characterizes the effect of augmentation on standard error in linear regression; proves RST improves robust error without sacrificing standard error.
result RST improves both standard and robust error for neural networks under various perturbations.
Adversarial training has been successfully applied to build robust models at a certain cost. While the robustness of a model increases, the standard classification accuracy declines. This phenomenon is suggested to be an inherent trade-off. We propose a model that employs feature prioritization by a nonlinear attention…
New expressive losses improve adversarial robustness without sacrificing accuracy.
problem Training networks for robustness at the expense of accuracy.
method Formalizing expressivity, using convex combinations of adversarial attacks and IBP bounds.
result Trivial expressive losses yield state-of-the-art results in various settings.
Validates neural networks inputs to protect against adversarial examples.
problem Ensuring neural networks robustness against adversarial attacks.
method Runtime local robustness verification based on normal distribution of robustness radii.
result Improves neural network accuracy and protects against adversarial examples.
Knowledge distillation is effective for producing small, high-performance neural networks for classification, but these small networks are vulnerable to adversarial attacks. This paper studies how adversarial robustness transfers from teacher to student during knowledge distillation. We find that a large amount of robu…
Empirical adversarial risk minimization (EARM) is a widely used mathematical framework to robustly train deep neural nets (DNNs) that are resistant to adversarial attacks. However, both natural and robust accuracies, in classifying clean and adversarial images, respectively, of the trained robust models are far from sa…