Adversarial Defense Via Local Flatness Regularization

By Jia Xu, Yiming Li, Yang Bai, Yong Jiang, Shutao Xia. 2019

21 citations recorded by the source corpus.

Adversarial defense is a popular and important research area. Due to its intrinsic mechanism, one of the most straightforward and effective ways of defending attacks is to analyze the property of loss surface in the input space. In this paper, we define the local flatness of the loss surface as the maximum value of the chosen norm of the gradient regarding to the input within a neighborhood centered on the benign sample, and discuss the relationship between the local flatness and adversarial vulnerability. Based on the analysis, we propose a novel defense approach via regularizing the local flatness, dubbed local flatness regularization (LFR). We also demonstrate the effectiveness of the proposed method from other perspectives, such as human visual mechanism, and analyze the relationship between LFR and other related methods theoretically. Experiments are conducted to verify our theory and demonstrate the superiority of the proposed method.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Zhifeng Li
2. Yong Jiang
3. Baoyuan Wu
4. Shutao Xia
5. Yiming Li

In Computer Vision and Pattern Recognition

1. Baoyuan Wu
2. Yong Jiang
3. Zhifeng Li
4. Shutao Xia
5. Yiming Li
6. Yu Qiao
7. Weihong Deng
8. Luc Van Gool

Citations in the corpus

• Class-Incremental Continual Learning Into the eXtended DER-Verse (2022, neutral): “In this regard, we evaluate two distinct approaches: • Local Flatness Regularizer (LFR) [61], which seeks to minimize the (cid:96) 1 norm of the loss gradients w.r.t. a malign example, the latter forged so that: i) it lies in a ε -neighborhood centered on a given (benign) example; ii) it maximizes…”
• Backdoor Learning: A Survey (2020, background): “For example, adversarial learning [1], [2], [3], [4], [5], [6], which discusses the security issues of the inference process, is well-studied.”