Are Accuracy and Robustness Correlated

By Andras Rozsa, Manuel Günther, Terrance E. Boult. 2016

62 citations recorded by the source corpus.

Machine learning models are vulnerable to adversarial examples formed by applying small carefully chosen perturbations to inputs that cause unexpected classification errors. In this paper, we perform experiments on various adversarial example generation approaches with multiple deep convolutional neural networks including Residual Networks, the best performing models on ImageNet Large-Scale Visual Recognition Challenge 2015. We compare the adversarial example generation techniques with respect to the quality of the produced images, and measure the robustness of the tested machine learning models to adversarial examples. Finally, we conduct large-scale experiments on cross-model adversarial portability. We find that adversarial examples are mostly transferable across similar network topologies, and we demonstrate that better machine learning models are less vulnerable to adversarial examples.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Adversarial Machine Learning at Scale (2016, background): “We adversarially trained an Inception v3 model (Szegedy et al., 2015) on ImageNet.”
On Detecting Adversarial Perturbations (2017, background): “An experiment on the cross-model adversarial portability (Rozsa et al., 2016) has shown that models with higher accuracies tend to be more robust against adversarial examples, while examples that fool them are more portable to less accurate models.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[97] empirically analyzed the correlation between the accuracy of eight deep network classifiers and their robustness to three adversarial attacks introduced in [23] and [94].”
Disentangling Adversarial Robustness and Generalization (2018, background): “The experimental results obtained in [95, 77] stem from comparing different architectures and training strategies; in contrast, we consider robustness and generalization for any arbitrary but fixed model.”
Adversarial frontier stitching for remote neural network watermarking (2017, background): ““adversaries”) very close the model’s decision frontiers. As such adversaries seem to generalize across models, notably across different neural network architectures for visual recognition, see e.g., Rozsa et al. (2016), this frontier tweaking should resist model manipulation and yield only few fals”
Towards Demystifying Membership Inference Attacks (2018, background): “Recent studies on adversarial machine learning attacks such as evasion attacks or poisoning attacks [42], [32], [31], [38] have shown that maliciously generated adversarial examples tend to transfer from one model to another.”
High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks (2019, background): “The empirical results in [49] demonstrated that more accurate model tend to be more robust over generated adversarial examples.”
Adversarial Examples on Object Recognition (2020, background): “Several publications suggested that DNNs capacity increases their robustness to adversarial examples[98, 115, 140].”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, result): “However, we also find works in the literature that suggest the opposite [301], [313], i.”
Adversarial Meta-Learning (2018, unknown): “Rozsa2016 et al. [16] conducted experiments on various adversarial sample generation methods with multiple deep Convolutional Neural Networks (CNNs), and found that adversarial samples are mostly trans-ferable across similar network topologies, and better learning models are less vulnerable.”
Demystifying Membership Inference Attacks in Machine Learning as a Service (2019, unknown): “Recent studies on adversarial machine learning attacks such as evasion attacks or poisoning attacks [30], [31], [32], [33] have shown that maliciously generated adversarial examples tend to transfer from one model to another.”