Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles

By Edward Grefenstette, Robert Stanforth, Brendan O'Donoghue, Jonathan Uesato, Grzegorz Swirszcz, Pushmeet Kohli. 2018

18 citations recorded by the source corpus.

While deep learning has led to remarkable results on a number of challenging problems, researchers have discovered a vulnerability of neural networks in adversarial settings, where small but carefully chosen perturbations to the input can make the models produce extremely inaccurate outputs. This makes these models particularly unsuitable for safety-critical application domains (e.g. self-driving cars) where robustness is extremely important. Recent work has shown that augmenting training with adversarially generated data provides some degree of robustness against test-time attacks. In this paper we investigate how this approach scales as we increase the computational budget given to the defender. We show that increasing the number of parameters in adversarially-trained models increases their robustness, and in particular that ensembling smaller models while adversarially training the entire ensemble as a single model is a more efficient way of spending said budget than simply using a larger single model. Crucially, we show that it is the adversarial training of the ensemble, rather than the ensembling of adversarially trained models, which provides robustness.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Beat the AI: Investigating Adversarial Human Annotation for Reading Comprehension (2020, methodology): “A possible takeaway for employing the model-in-the-loop annotation strategy in the future is to rely on ensembles of adversaries and reduce the dependency on one particular model instantiation, as investigated by Grefenstette et al. (2018).”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, background): “In particular, Tramèr et al. (2017); Grefenstette et al. (2018) found that ensembling could reduce the risk of gradient obfuscation caused by locally non-linear loss surfaces.”
Relating Adversarially Robust Generalization to Flat Minima (2021, unknown): “Originally proposed in different variants in [56, 40, 24], it received considerable attention in [37, 16] and has been extended in various ways: [33, 7, 2] utilize interpolated or unlabeled examples, [57, 38] achieve robustness against multiple threat models, [54, 32, 64] augment AT with a reject op”
Data Augmentation Can Improve Robustness (2021, background): “In particular, Grefenstette et al. [22], Tramèr et al. [51] found that ensembling could reduce the risk of gradient obfuscation caused by locally non-linear loss surfaces.”