Towards Robust Deep Neural Networks with BANG

By Andras Rozsa, Manuel Günther, Terrance E. Boult. 2016

78 citations recorded by the source corpus.

Machine learning models, including state-of-the-art deep neural networks, are vulnerable to small perturbations that cause unexpected classification errors. This unexpected lack of robustness raises fundamental questions about their generalization properties and poses a serious concern for practical deployments. As such perturbations can remain imperceptible – the formed adversarial examples demonstrate an inherent inconsistency between vulnerable machine learning models and human perception – some prior work casts this problem as a security issue. Despite the significance of the discovered instabilities and ensuing research, their cause is not well understood and no effective method has been developed to address the problem. In this paper, we present a novel theory to explain why this unpleasant phenomenon exists in deep neural networks. Based on that theory, we introduce a simple, efficient, and effective training approach, Batch Adjusted Network Gradients (BANG), which significantly improves the robustness of machine learning models. While the BANG technique does not rely on any form of data augmentation or the utilization of adversarial images for training, the resultant classifiers are more resistant to adversarial perturbations while maintaining or even enhancing the overall classification performance.

Subfields: Artificial Intelligence, Radiology, Nuclear Medicine and Imaging

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Radiology, Nuclear Medicine and Imaging

Citations in the corpus

Certifying Some Distributional Robustness with Principled Adversarial Training (2017, background): “Consequently, researchers have proposed adversarial attack and defense mechanisms (Papernot et al., 2016a;b;c; Rozsa et al., 2016; Carlini & Wagner, 2017; He et al., 2017; Madry et al., 2017; Tramèr et al., 2017).”
Measuring the tendency of CNNs to Learn Surface Statistical Regularities (2017, methodology): “Speciﬁcally [33] modiﬁes SGD by rescaling the batch gradients and reports an increased robustness to adversarial examples for the MNIST and CIFAR-10 datasets, though the CIFAR-10 models suffer a non-trivial degradation in clean test accuracy.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[102] hypothesized that the existence of adversarial perturbations is a result of evolutionary stalling of decision boundaries on training images.”
Quality Resilient Deep Neural Networks (2017, methodology): “BANG training [20] is a method for training neural networks that are less susceptible to noisy input data.”
Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “This phenomenon has received particular attention in the context of deep neural networks, and there is now a quickly growing body of work on this topic [6, 13, 17, 19, 24, 22, 26].”
Improving DNN Robustness to Adversarial Attacks using Jacobian Regularization (2018, methodology): “These defense methods include, among others, Adversarial Training [2] which adds perturbed inputs along with their correct labels to the training dataset; Defensive Distillation [15], which trains two networks, where the first is a standard classification network and the second is trained to achieve”
Adversarial Examples on Object Recognition (2020, background): “[141] believe that the gradients of correctly classified inputs diminish during training and fail to create flat regions around the training data.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Evolutionary stalling [302] is another interesting hypothesis, according to which, the inability of training samples to contribute beyond a certain capacity leaves their representation very close to the model decision boundaries.”
Certifiable Distributional Robustness with Principled Adversarial Training (2017, background): “Subsequently, many researchers have proposed adversarial attack and defense mechanisms [40, 35, 36, 37, 44, 11, 29, 21].”
NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks (2019, background): “Nonetheless, defense methods (Papernot et al., 2015; Tram`er et al., 2017a; Rozsa et al., 2016; Madry et al., 2018) motivated by them were broken in a short amount of time (He et al., 2017; Athalye et al., 2018; Xu et al., 2017; Sharma & Chen, 2017), indicating that better defense techniques are…”