Transfer of Adversarial Robustness Between Perturbation Types

By Daniel Kang, Yi Sun, Tom B. Brown, Dan Hendrycks, Jacob Steinhardt. 2019

53 citations recorded by the source corpus.

We study the transfer of adversarial robustness of deep neural networks between different perturbation types. While most work on adversarial examples has focused on $L_\infty$ and $L_2$-bounded perturbations, these do not capture all types of perturbations available to an adversary. The present work evaluates 32 attacks of 5 different types against models adversarially trained on a 100-class subset of ImageNet. Our empirical results suggest that evaluating on a wide range of perturbation sizes is necessary to understand whether adversarial robustness transfers between perturbation types. We further demonstrate that robustness against one perturbation type may not always imply and may sometimes hurt robustness against other perturbation types. In light of these results, we recommend evaluation of adversarial defenses take place on a diverse range of perturbation types and sizes.

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, methodology): “By creating a testbed 100 × larger than prior work [27, 33, 47, 68], we are able to make several new observations.”
Natural Adversarial Examples (2019, background): “Two of these, Stylized ImageNet data augmentation [13] and `∞ adversarial example training on an ImageNet scale [28], hardly increase robustness to natural adversarial examples.”
Adversarial Training and Robustness for Multiple Perturbations (2019, methodology): “It outperforms the steepest descent attack as well as a recently proposed Frank-Wolfe algorithm for `1-attacks [20] (see Appendix B).”
Recent Advances in Adversarial Training for Adversarial Robustness (2021, background): “, other lp norms, or larger ǫ, or different target models [Kang et al., 2019].”
Test-Time Training with Self-Supervision for Generalization under Distribution Shifts (2019, methodology): “For the ﬁrst two noise types, TTT-Online also achieves better results over unsupervised domain adaptation by self-supervision (UDA-SS) (Sun et al., 2019).”
Adversarial Robustness Against the Union of Multiple Perturbation Models (2019, background): “Finally, while not studied as a defense, Kang et al. (2019) study”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “bounded by `0, `1-norm or adversarial patches 361 [11, 24, 84, 27], (2) multiple `p-norm perturbations [125, 81], (3) adversarially optimized common 362 corruptions [62, 63], (4) a broad set of perturbations unseen during training [73].”
Test-Time Training for Out-of-Distribution Generalization (2019, methodology): “We are inspired by this very active and successful community, especially (Sun et al., 2019), and believe that progress in this community can motivate new algorithms in the framework of test-time learning.”
A Simple Way to Make Neural Networks Robust Against Diverse Image Corruptions (2020, background): “Kang et al. study robustness transfer between models trained against (cid:96) 1 , (cid:96) 2 , (cid:96) ∞ adversaries / elastic deformations and JPEG artifacts [17].”
Increasing the robustness of DNNs against image corruptions by playing the Game of Noise (2020, background): “Kang et al. [2019] study robustness transfer between models trained against 1 , 2 , ∞ adversaries / elastic deformations and JPEG artifacts.”