Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization

By Uri Shaham, Yutaro Yamada, Sahand N. Negahban. 2015

378 citations recorded by the source corpus.

Subfields: Optimization & Training, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Optimization & Training

In Safety, Robustness & Interpretability

Citations in the corpus

Towards Evaluating the Robustness of Neural Networks (2016, background): “…examples not only limits their potential application settings, but entirely defeats its purpose: an adversary who is able to make only slight modifications to a malware file that cause it to remain malware, but become classified as benign, has entirely defeated the malware classifier [8], [14].”
AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation (2018, background): “, [3], [12], [14], [15], [17], [18], [29], [30], [32], [38], [41]).”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “Common defense approaches involve modifying the training dataset such that the classiﬁer is made more robust [20], [41], modifying the network architecture to increase robustness [11] or performing defensive distillation [37].”
MagNet: A Two-Pronged Defense against Adversarial Examples (2017, background): “One idea of defending against adversarial examples is to train a better classifier [30].”
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods (2017, background): “There has been a significant amount of work studying methods to construct adversarial examples [5, 8, 13, 26, 30, 39] and to make networks robust against adversarial examples [3, 16, 20, 21, 31, 33, 34, 41].”
DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, background): “This observation has inspired several researchers to try to improve the robustness and reliability of DNNs [9, 13, 17, 30, 32, 46, 51, 53, 62, 84, 89, 90].”
Parseval Networks: Improving Robustness to Adversarial Examples (2017, methodology): “This data augmentation method can be interpreted as a robust optimization procedure (Shaham et al., 2015).”
Countering Adversarial Images using Input Transformations (2018, background): “The first category comprises model-specific strategies that enforce model properties such as invariance and smoothness via the learning algorithm or regularization scheme (Shaham et al., 2015; Kurakin et al., 2016a; Cisse et al., 2017b), potentially exploiting knowledge about the adversary’s attack ”
Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics (2016, methodology): “[25, 8] propose approaches to sample adversaries or minimax optimization for making learning more robust.”
Measuring Neural Net Robustness with Constraints (2016, background): “In Figure 1 note that the direction of the nearest adversarial example is not necessary aligned with the signed gradient of the loss function, as observed by others [7].”
Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation (2017, background): “Robust optimization has been suggested as a measure against adversarial manipulation [12, 21] which effectively boils down to adversarial training in practice.”
Robustness of classifiers: from adversarial to random noise (2016, background): “More recently, following the recent results on the instability of deep neural networks to worst-case perturbations [17], several works have provided explanations of the phenomenon [3, 5, 14, 18], and designed more robust networks [6, 8, 20, 13, 15, 12].”
Measuring the tendency of CNNs to Learn Surface Statistical Regularities (2017, methodology): “The most popular adversarial robustness method has been adversarial training [9, 22, 24, 36, 40, 20].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[27] attempted to improve the local stability of neural networks byminimizing the loss of a model over adversarial examples at each parameter update.”
ConvNets and ImageNet Beyond Accuracy: Explanations, Bias Detection, Adversarial Examples and Model Criticism (2017, methodology): “Several studies have subsequently analyzed the phenomenon [11, 40, 12, 12] and various approaches have been proposed to improve the robustness of neural networks [34, 8, 44, 46, 19].”
Adversarial vulnerability for any classifier (2018, background): “A large number of techniques have recently been proposed to improve the robustness of classifiers to perturbations, such as adversarial training [8], robust optimization [9, 10], regularization [11], distillation [12], stochastic networks [13], etc.”
Hessian-based Analysis of Large Batch Training and Robustness to Adversaries (2018, background): “In [28, 29], the authors proposed that the training can be viewed as a stochastic differential equation, and argued that the optimum batch size is proportional to the training size and the learning rate.”
Adversarial Attacks and Defences: A Survey (2018, background): “In the white-box setting, the adversary acts as an insider within the privacy-preserving [66] collaborative deep learning protocol.”