Adversarial Robustness Against the Union of Multiple Perturbation Models

By Pratyush Maini, Eric Wong, J. Kolter. 2019

175 citations recorded by the source corpus.

Owing to the susceptibility of deep learning systems to adversarial attacks, there has been a great deal of work in developing (both empirically and certifiably) robust classifiers, but the vast majority has defended against single types of attacks. Recent work has looked at defending against multiple attacks, specifically on the MNIST dataset, yet this approach used a relatively complex architecture, claiming that standard adversarial training can not apply because it "overfits" to a particular norm. In this work, we show that it is indeed possible to adversarially train a robust model against a union of norm-bounded attacks, by using a natural generalization of the standard PGD-based procedure for adversarial training to multiple threat models. With this approach, we are able to train standard architectures which are robust against $\ell_\infty$, $\ell_2$, and $\ell_1$ attacks, outperforming past approaches on the MNIST dataset and providing the first CIFAR10 network trained to be simultaneously robust against $(\ell_{\infty}, \ell_{2},\ell_{1})$ threat models, which achieves adversarial accuracy rates of $(47.6\%, 64.8\%, 53.4\%)$ for $(\ell_{\infty}, \ell_{2},\ell_{1})$ perturbations with radius $\epsilon = (0.03,0.5,12)$.

Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Molecular Biology

In Safety, Robustness & Interpretability

Citations in the corpus

Measuring Robustness to Natural Distribution Shifts in Image Classification (2020, background): “Encouragingly, the past few years have seen substantial progress in robustness to these distribution shifts, e.g., see [13, 28, 34, 55, 57, 66, 93, 96, 105, 114, 115] among many others.”
Fast is better than free: Revisiting adversarial training (2020, background): “…tricks like momentum to improve the adversary (Dong et al., 2018), combination with other heuristic defenses like matrix estimation (Yang et al., 2019) or logit pairing (Mosbach et al., 2018), and generalization to multiple types of adversarial attacks (Tram`er & Boneh, 2019; Maini et al., 2019).”
Trustworthy AI: From Principles to Practices (2021, background): “Reference [231] combined multiple types of perturbations into adversarial training to improve the robustness of the model against multiple types of attacks.”
RobustBench: a standardized adversarial robustness benchmark (2020, background): “bounded by `0, `1-norm or adversarial patches 361 [11, 24, 84, 27], (2) multiple `p-norm perturbations [125, 81], (3) adversarially optimized common 362 corruptions [62, 63], (4) a broad set of perturbations unseen during training [73].”
Overfitting in adversarially robust deep learning (2020, methodology): “…works have also expanded the general PGD adversarial training algorithm to different threat models including image transformations (Engstrom et al., 2017; Xiao et al., 2018a), different distance metrics (Wong et al., 2019), and multiple threat models (Maini et al., 2019; Tram`er & Boneh, 2019).”
Towards Deep Learning Models Resistant to Large Perturbations (2020, background): “Researchers have also tried to apply adversarial training on more natural classes of perturbations such as translations and rotations for images (Engstrom et al., 2017), or on the mixture of perturbations (Maini et al., 2019; Tramer & Boneh, 2019).”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, methodology): “[349] proposed to incorporate several perturbations into a single attack by taking the worst-case over the entire steepest directions as an extension to the standard PGD.”