Improving Adversarial Robustness via Promoting Ensemble Diversity

By Tianyu Pang, Kun Xu, Chao Du, Ning Chen, Jun Zhu. 2019

504 citations recorded by the source corpus.

Though deep neural networks have achieved significant progress on various tasks, often enhanced by model ensemble, existing high-performance models can be vulnerable to adversarial attacks. Many efforts have been devoted to enhancing the robustness of individual networks and then constructing a straightforward ensemble, e.g., by directly averaging the outputs, which ignores the interaction among networks. This paper presents a new method that explores the interaction among individual networks to improve robustness for ensemble models. Technically, we define a new notion of ensemble diversity in the adversarial setting as the diversity among non-maximal predictions of individual members, and present an adaptive diversity promoting (ADP) regularizer to encourage the diversity, which leads to globally better robustness for the ensemble by making adversarial examples difficult to transfer among individual members. Our method is computationally efficient and compatible with the defense methods acting on individual networks. Empirical results on various datasets verify that our method can improve adversarial robustness while maintaining state-of-the-art accuracy on normal examples.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Efficient and Scalable Bayesian Neural Nets with Rank-1 Factors (2020, background): “The diversity of predictions returned by different members of an ensemble is an important indicator of the quality of uncertainty quantiﬁcation (Fort et al., 2019) and of the robustness of the ensemble (Pang et al., 2019).”
Data Augmentation Can Improve Robustness (2021, background): “Although mildly successful, we note that ensembling has received some attention in the context of adversarial training [38, 47].”
When NAS Meets Robustness: In Search of Robust Architectures Against Adversarial Attacks (2019, background): “Extensive efforts have been proposed to enhance the robustness, including preprocessing techniques [3, 28, 38], feature denoising [35], regularization [41, 13, 17], adding unlabeled data [6, 29], model ensemble [33, 24], where adversarial training [9, 21] turns out to be the most effective and stand”
BERT Loses Patience: Fast and Robust Inference with Early Exit (2020, result): “This effect is similar to the merits of Ensemble Learning against adversarial attack, discussed in previous studies [48–50].”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, background): “Although mildly successful, we note that ensembling has received some attention in the context of adversarial training (Pang et al., 2019; Strauss et al., 2017).”
Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning (2020, methodology): “Recent proposals [26, 37] formulate the diversity as a training regularizer for improved ensemble defense.”
On the Robustness of Vision Transformers to Adversarial Examples (2021, methodology): “Here we consider three ways commonly found in the literature, majority voting [27], absolute consensus [26] and random selection [32].”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, background): “, 2020), ensemble adversarial training (Tramr et al., 2018; Pang et al., 2019), and adversarial training by utilizing unlabeled data (Carmon et al.”
The Pitfalls of Simplicity Bias in Neural Networks (2020, background): “Standard approaches to mitigate this issue—adversarial training [23, 42] and ensembles [69, 54, 37]—have had limited success on large-scale datasets.”
PromptRobust: Towards Evaluating the Robustness of Large Language Models on Adversarial Prompts (2023, unknown): “Thus, one promising countermeasure is the utilization of diverse models (Jacobs et al., 1991; Shazeer et al., 2017; Pang et al., 2019), training them independently, and subsequently ensembling their outputs.”
Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “[37] propose to promote the diversity among the predictions of different models, and introduce an adaptive diversity promoting regularizer to achieve this.”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “, 2020; Wang & Liu, 2022), ensemble learning (Tramèr et al., 2018; Pang et al., 2019), fairness (Ma et al.”
Adversarially Robust Neural Architectures (2020, unknown): “Pang et al. [47] introduced adaptive diversity promoting (ADP) which improved the adversarial robustness of ensemble models.”
Metric Learning for Adversarial Robustness (2019, methodology): “Extensive efforts [37, 31, 47, 7, 25, 12, 35, 48] have been made to study and enhance the robustness of deep networks against adversarial attacks, where a defense method called adversarial training achieves the state-of-the-art adversarial robustness [19, 16, 46, 49].”
Cross-Entropy Loss Functions: Theoretical Analysis and Applications (2023, background): “…(Shafahi et al., 2019; Zhang et al., 2019a; Wong et al., 2020; Andriushchenko & Flammarion, 2020), ensemble techniques (Tramèr et al., 2018; Pang et al., 2019; Yang et al., 2020; Guo et al., 2022), unlabeled data (Carmon et al., 2019; Alayrac et al., 2019; Zhai et al., 2019), data…”
Boosting Adversarial Training with Hypersphere Embedding (2020, background): “Along this line, recent progress shows that encoding triplet-wise metric learning or maximizing the optimal transport (OT) distance of data batch in AT is effective to leverage the inter-sample interactions, which can promote the learning of robust classifiers [34, 41, 45, 80].”
On Adaptive Attacks to Adversarial Example Defenses (2020, background): “…2018) Section 9 Rethinking Cross Entropy (Pang et al., 2020a) Section 10 Error Correcting Codes (Verma & Swami, 2019) Section 11 Ensemble Diversity (Pang et al., 2019) Section 12 EMPIR (Sen et al., 2020) Section 13 Temporal Dependency (Yang et al., 2019b) Section 14 Mixup Inference (Pang et al.,…”