Universal Adversarial Training

By Ali Shafahi, Mahyar Najibi, Zheng Xu, John P. Dickerson, Larry S. Davis, Tom Goldstein. 2018

211 citations recorded by the source corpus.

Standard adversarial attacks change the predicted class label of a selected image by adding specially tailored small perturbations to its pixels. In contrast, a universal perturbation is an update that can be added to any image in a broad class of images, while still changing the predicted class label. We study the efficient generation of universal adversarial perturbations, and also efficient methods for hardening networks to these attacks. We propose a simple optimization-based universal attack that reduces the top-1 accuracy of various network architectures on ImageNet to less than 20%, while learning the universal perturbation 13× faster than the standard method.To defend against these perturbations, we propose universal adversarial training, which models the problem of robust classifier generation as a two-player min-max game, and produces robust models with only 2× the cost of natural training. We also propose a simultaneous stochastic gradient method that is almost free of extra computation, which allows us to do universal adversarial training on ImageNet.

Subfields: Artificial Intelligence, Molecular Biology

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

Citations in the corpus

Adversarial Training for Free! (2019, background): “…et al., 2018], PixelDefend [Song et al., 2017], Robust Manifold Defense [Ilyas et al., 2017], L2-nonexpansive nets [Qian and Wegman, 2018], Jacobian Regularization [Jakubovitz and Giryes, 2018], Universal Perturbation [Shafahi et al., 2018], and Stochastic Activation Pruning [Dhillon et al., 2018].”
A Survey On Universal Adversarial Attack (2021, methodology): “The simple methods which directly update the perturbation with the calculated gradient proposed in [Zhang et al., 2020b; Shafahi et al., 2020] demonstrate that a direct optimization of the UAP does not only remove the requirement to train a separate generative network but can also achieve superior…”
Invisible Backdoor Attacks on Deep Neural Networks Via Steganography and Regularization (2019, background): “There are many adversarial attacks; for example, universal adversarial attacks [23, 24], will try to iteratively search the whole dataset to ﬁnd this shortcut for their universal adversarial examples.”
Increasing the robustness of DNNs against image corruptions by playing the Game of Noise (2020, methodology): “Other defenses against UAPs are similarly based on adversarial training [Metzen, 2018, Shafahi et al., 2018, Mummadi et al., 2019, Pérolat et al., 2018].”
A Simple Way to Make Neural Networks Robust Against Diverse Image Corruptions (2020, result): “Universal adversarial training [37], on the other hand, leads to severe drops on some corruptions but the overall accuracy on ImageNet-C is slightly increased relative to the vanilla baseline model (AlexNet).”
Yes, we GAN: Applying Adversarial Techniques for Autonomous Driving (2019, background): “In the Universal Adversarial Training [65], instead of adding tailored perturbations to an image, an update can be added to any image in a broad class of images, while changing the predicted classes.”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, methodology): “[50] also have a similar observation on the universal adversarially trained models.”