Improving Adversarial Robustness Requires Revisiting Misclassified Examples

By Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, Quanquan Gu. International Conference on Learning Representations, 2020

849 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/764eff31d9596033859895d9513b838d2c57a6fb

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

A Closer Look at Accuracy vs. Robustness (2020, background): “There is a large body of literature on developing adversarial attacks as well as defenses that apply to neural networks [7, 29, 56, 30, 32, 36, 35, 53, 58, 67].”
Orthogonal Projection Loss (2021, unknown): “[58] introduce a surrogate loss along with cross-entropy.”
Adversarial Weight Perturbation Helps Robust Generalization (2020, methodology): “Two types of adversarial training methods are considered here: One is only based on original data: 1) AT [25]; 2) TRADES [58]; and 3) MART [49].”
Do Wider Neural Networks Really Help Adversarial Robustness? (2020, methodology): “Note that previous works [70, 63] report their results using step size 0.”
Better Diffusion Models Further Improve Adversarial Training (2023, background): “Thus, several pioneer efforts are made to incorporate external datasets into AT (Hendrycks et al., 2019; Carmon et al., 2019; Alayrac et al., 2019; Najafi et al., 2019; Zhai et al., 2019; Wang et al., 2020), either in a fully-supervised or semi-supervised learning paradigm.”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, background): “, 2019b) and MART (Wang et al., 2020)) special cases when τ = K.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, methodology): “Most notably, without additional data, we improve on the results of three methods that used additional data (Hendrycks et al., 2019; Uesato et al., 2019; Wang et al., 2020).”
Smooth Adversarial Training (2020, background): “Existing works suggest that, to further adversarial robustness, we need to either sacriﬁce accuracy on clean inputs [68, 69, 79, 13], or incur additional computational cost [38, 75, 74].”
Recent Advances in Adversarial Training for Adversarial Robustness (2021, unknown): “[Wang et al. , 2020] investigated the inﬂuence of misclassiﬁed examples and proposed Misclassiﬁcation Aware adveRsarial Training (MART), which emphasizes on misclassiﬁed examples using the output probability 1 − p y ( x, θ ) .”
Adversarial Robustness with Semi-Infinite Constrained Learning (2021, methodology): “The third approximation of Algorithm 1, or more precisely, ( (cid:99) DI), is the use of a ﬁxed ν > 0 , e.g., [53, 54, 95].”
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “fool state-of-the-art DNNs with high success rate [19,58,44,64,65,67,28,29].”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “In our experiments, we consider several popular variants [62, 60, 72, 7, 22].”
Defense without Forgetting: Continual Adversarial Defense with Anisotropic & Isotropic Pseudo Replay (2024, background): “Recently, adversarial training (AT) [16, 18, 27] and defensive distillation [15, 46, 46, 55] have become mainstream defense due to their essential robustness, and the latest research primarily focus on exploring their potential.”
Clean-Label Backdoor Attacks on Video Recognition Models (2020, background): “Despite great success, DNNs have been criticized due to their low transparency, poor interpretability, and more importantly vulnerabilities to adversarial attacks [25, 8, 16, 30, 32, 31] and backdoor attacks [9, 2, 15, 28, 33].”
Jailbreaking Black Box Large Language Models in Twenty Queries (2023, unknown): “We start by comparing the performance of PAIR and GCG when both algorithms directly attack various targeted LLMs.”
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “A type of well-studied adversary is called the adversarial attack (Szegedy et al., 2013; Goodfellow et al., 2014; Ma et al., 2018; Jiang et al., 2019; Wang et al., 2019b; 2020; Duan et al., 2020; Ma et al., 2020).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “For example, a Missclassification Aware adveRsarial Training (MART) is proposed in [332] to incorporate distinctive influence of clean misclassified examples in the training process.”
Adversarial Machine Learning for Network Intrusion Detection Systems: A Comprehensive Survey (2023, background): “Aware adveRsarial Training (MART) [149] emphasises adversarial examples that are generated based on misclassiﬁed examples rather than correctly classiﬁed examples.”