Robustifying $\ell_\infty$ Adversarial Training to the Union of Perturbation Models Article Swipe

MAKE IMPACT

Ameya D. Patil , Michael Tuttle , Alexander G. Schwing , Naresh R. Shanbhag · YOU? · · 2021 · Open Access · · DOI: https://doi.org/10.48550/arxiv.2105.14710

Classical adversarial training (AT) frameworks are designed to achieve high adversarial accuracy against a single attack type, typically $\ell_\infty$ norm-bounded perturbations. Recent extensions in AT have focused on defending against the union of multiple perturbations but this benefit is obtained at the expense of a significant (up to $10\times$) increase in training complexity over single-attack $\ell_\infty$ AT. In this work, we expand the capabilities of widely popular single-attack $\ell_\infty$ AT frameworks to provide robustness to the union of ($\ell_\infty, \ell_2, \ell_1$) perturbations while preserving their training efficiency. Our technique, referred to as Shaped Noise Augmented Processing (SNAP), exploits a well-established byproduct of single-attack AT frameworks -- the reduction in the curvature of the decision boundary of networks. SNAP prepends a given deep net with a shaped noise augmentation layer whose distribution is learned along with network parameters using any standard single-attack AT. As a result, SNAP enhances adversarial accuracy of ResNet-18 on CIFAR-10 against the union of ($\ell_\infty, \ell_2, \ell_1$) perturbations by 14%-to-20% for four state-of-the-art (SOTA) single-attack $\ell_\infty$ AT frameworks, and, for the first time, establishes a benchmark for ResNet-50 and ResNet-101 on ImageNet.

Type

preprint

Language

en

Landing Page

http://arxiv.org/abs/2105.14710

PDF

https://arxiv.org/pdf/2105.14710

OA Status

green

References

49

Related Works

10

OpenAlex ID

https://openalex.org/W3172980906

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W3172980906

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.48550/arxiv.2105.14710

Digital Object Identifier

Title

Robustifying $\ell_\infty$ Adversarial Training to the Union of Perturbation Models

Work title

Type

preprint

OpenAlex work type

Language

en

Primary language

Publication year

2021

Year of publication

Publication date

2021-05-31

Full publication date if available

Authors

Ameya D. Patil, Michael Tuttle, Alexander G. Schwing, Naresh R. Shanbhag

List of authors in order

Landing page

https://arxiv.org/abs/2105.14710

Publisher landing page

PDF URL

https://arxiv.org/pdf/2105.14710

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

green

Open access status per OpenAlex

OA URL

https://arxiv.org/pdf/2105.14710

Direct OA link when available

Concepts

Decision boundary, Norm (philosophy), Bounded function, Adversarial system, Mathematics, Perturbation (astronomy), Robustness (evolution), Exploit, Algorithm, Discrete mathematics, Computer science, Topology (electrical circuits), Combinatorics, Artificial intelligence, Mathematical analysis, Physics, Political science, Computer security, Classifier (UML), Biochemistry, Quantum mechanics, Gene, Chemistry, Law

Top concepts (fields/topics) attached by OpenAlex

Cited by

0

Total citation count in OpenAlex

References (count)

49

Number of works referenced by this work

Related works (count)

10

Other works algorithmically related by OpenAlex

Full payload