Analysis of classifiers’ robustness to adversarial perturbations

By Alhussein Fawzi, Omar Fawzi, Pascal Frossard. 2017

Subfields: Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

Citations in the corpus

Parseval Networks: Improving Robustness to Adversarial Examples (2017, neutral): “Some authors argued that this sensitivity of deep networks to small changes in their inputs is because neural networks only learn the discriminative information sufﬁcient to obtain good accuracy rather than capturing the true concepts deﬁning the classes (Fawzi et al., 2015; Nguyen et al., 2015).”
Safety Verification of Deep Neural Networks (2016, neutral): “We remark that, unlike the notions of risk [37] and robustness of [18,12], we work with safety for a speciﬁc point and do not account for the input distribution, but such expectation measures can be considered, see Section 6 for comparison.”
A Unified Gradient Regularization Family for Adversarial Examples (2015, positive): “A recent theoretical study suggests there is a relationship between adversarial examples and Gaussian noise [6], we hav e used testing errors under Gaussian noise as a criterion to te st whether our regularization technique improves the models’ robustness against perturbations.”
Universal Adversarial Perturbations (2016, neutral): “The robustness of image classiﬁers to structured and un-structured perturbations have recently attracted a lot of attention [19, 16, 20, 3, 4, 12, 13, 14].”
Robustness May Be at Odds with Accuracy (2018, positive): “Due to the large body of related work, we will only focus on the most relevant studies here and defer the full discussion to Appendix F. Fawzi et al. (2018b) prove upper bounds on the robust of classiﬁers and exhibit a standard vs. robust accuracy trade-oﬀ for a speciﬁc classiﬁer families on a…”
The Space of Transferable Adversarial Examples (2017, positive): “Following [5], we need (cid:15) ≈ (cid:107) δ φ (cid:107) 2 on average to fool f (see Appendix C.2).”
Robustness of classifiers: from adversarial to random noise (2016, neutral): “More recently, following the recent results on the instability of deep neural networks to worst-case perturbations [18], several works have provided explanations of the phenomenon [4, 6, 15, 19], and designed more robust networks [7, 9, 21, 14, 16, 13].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, unknown): “The adversarial examples are almost always close to decision boundary of a natural trained model, which may be because the decision boundary is too flat (Fawzi et al., 2016), too curved (Moosavi-Dezfooli et al., 2017b), or inflexible (Fawzi et al., 2018).”
DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks (2015, unknown): “We should ﬁnally mention that the phenomenon of adversarial instability also led to theoretical work in [2] that studied the problem of adversarial perturbations on some families of classiﬁers, and provided upper bounds on the robustness of these classiﬁers.”
Adversarial Attacks Against Automatic Speech Recognition Systems via Psychoacoustic Hiding (2018, unknown): “The general question if ML-based systems can be secure has been investigated in the past [7], [6], [28] and some works have helped to elucidate the phenomenon of adversarial examples [20], [17], [18], [49], [27].”
Towards Deep Learning Models Resistant to Adversarial Attacks (2017, unknown): “Due to the growing body of work on adversarial examples [8, 6, 23, 17, 3, 25, 7, 12], we focus only on the most related papers here.”
Exploring the Space of Black-box Attacks on Deep Neural Networks (2017, unknown): “With no knowledge of f or the training set, the simplest manner in which an adversary may seek to carry out an attack is by adding a random perturbation to the input (Szegedy et al., 2014; Goodfellow et al., 2015; Fawzi et al., 2015).”
Towards Verified Artificial Intelligence (2016, unknown): “Recent efforts have shown that various machine learning algorithms can fail under small adversarial perturbations [39, 21, 37, 24].”
Robustness via Curvature Regularization, and Vice Versa (2018, unknown): “On the analysis front, many works have analyzed the existence of adversarial examples, and proposed several hypotheses for their existence [7, 9, 23, 6, 13].”