Certifiable Distributional Robustness with Principled Adversarial Training

By Aman Sinha, Hongseok Namkoong, John C. Duchi. 2017

374 citations recorded by the source corpus.

Subfields: Optimization & Training, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Optimization & Training

In Safety, Robustness & Interpretability

Citations in the corpus

Stronger data poisoning attacks break data sanitization defenses (2018, background): “Designing models that are robust to such attacks, as well as coming up with more effective attacks, is an active area of research (Papernot et al., 2016c; Madry et al., 2017; Tramèr et al., 2017; Wong & Kolter, 2018; Raghunathan et al., 2018; Sinha et al., 2018; Athalye et al., 2018; Papernot & McDa”
Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples (2018, methodology): “We omit two defenses with provable security claims (Raghunathan et al., 2018; Sinha et al., 2018) and one that only argues black-box security (Tramèr et al.”
A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations (2017, background): “Only recently, it has been demonstrated [19, 3, 22] that robust optimization approaches (also known as adversarial training) can reliably increase the resilience of neural network classifiers to a broad class of adversarial examples.”
Ensemble Adversarial Training: Attacks and Defenses (2017, background): “, `∞ bounded perturbations (Madry et al., 2017; Sinha et al., 2018; Raghunathan et al., 2018; Kolter & Wong, 2017)), yet they also fail to extend to other adversaries not considered at training time (see Appendix C.”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “The idea of adversarial training [18] and its connection to robust optimization [41, 32, 43] leads to a fruitful line of defenses.”
Adversarial Vulnerability of Neural Networks Increases With Input Dimension (2018, background): “…the adversarial damage E x [∆ ( x , c )] with loss L rather than L 0 / 1 . classiﬁer L Like for Goodfellow et al. (2015); Lyu et al. (2015); Sinha et al. (2018) and many others, a ϕ will hence be robust if, on average over x , a small adversarial perturbation δ of x creates only a small…”
Conditional variance penalties and domain shift robustness (2017, background): “An unconditional variance penalty, in contrast, can achieve robustness against a pre-deﬁned class of distributions such as a ball of distributions deﬁned in a Kullback-Leibler or Wasserstein metric; see for example Sinha et al. (2017) for an application in the context of adversarial examples.”
Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks (2018, background): “[27] proposed a certifiable procedure of adversarial training.”
Robustness May Be at Odds with Accuracy (2018, background): “Adversarial training The most successful approach to building adversarially robust models so far (Madry et al., 2017; Kolter & Wong, 2017; Sinha et al., 2017; Raghunathan et al., 2018) was so-called adversarial training (Goodfellow et al., 2014b).”
Scaling provable adversarial defenses (2018, background): “…not formally veriﬁed in the strict sense during training, nonetheless have substantial theoretical justiﬁcation for why they may perform well: Sinha et al. [2018] uses properties of statistical robustness to develop an approach that is not much more difﬁcult to train and which empirically…”
Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (2018, background): “Of particular interest are training procedures which optimize certiﬁcates of robustness (Kolter and Wong, 2017; Raghunathan et al., 2018; Sinha et al., 2017) to produce models with provable guarantees.”
Adversarial vulnerability for any classifier (2018, methodology): “Other works have recently studied procedures and algorithms to provably guarantee a certain level of robustness [22, 23, 24, 25, 26], and have been applied to small datasets (e.”
Unlabeled Data Improves Adversarial Robustness (2019, background): “[32] extend the distributionally robust optimization perspective of [43] to a semisupervised setting.”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, background): “These include augmenting training data with adversarial examples [2, 9, 10, 11], removing adversarial perturbations [12, 13, 14], and encouraging smoothness for the classifier [15].”
The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure (2018, background): “There is also a recent line of work that which provides robustness guarantees on individual instances, up to certain degree (Kolter and Wong 2017; Raghunathan, Steinhardt, and Liang 2018; Sinha, Namkoong, and Duchi 2017; Wong et al. 2018).”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”