Unifying Adversarial Training Algorithms with Flexible Deep Data Gradient Regularization

By Alexander Ororbia, C. Lee Giles, Daniel Kifer. 2016

24 citations recorded by the source corpus.

Many previous proposals for adversarial training of deep neural nets have included di- rectly modifying the gradient, training on a mix of original and adversarial examples, using contractive penalties, and approximately optimizing constrained adversarial ob- jective functions. In this paper, we show these proposals are actually all instances of optimizing a general, regularized objective we call DataGrad. Our proposed DataGrad framework, which can be viewed as a deep extension of the layerwise contractive au- toencoder penalty, cleanly simplifies prior work and easily allows extensions such as adversarial training with multi-task cues. In our experiments, we find that the deep gra- dient regularization of DataGrad (which also has L1 and L2 flavors of regularization) outperforms alternative forms of regularization, including classical L1, L2, and multi- task, both on the original dataset as well as on adversarial sets. Furthermore, we find that combining multi-task optimization with DataGrad adversarial training results in the most robust performance.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Optimization & Training, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Optimization & Training

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, neutral): “to other gradient-based penalties in [82], [83].”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[194] show that many different proposals of adversarial training are instances of more general regularized objective, they termed DataGrad.”
Adversary Resistant Deep Neural Networks with an Application to Malware Detection (2016, methodology): “Despite the fact that there exists an in - nite amount of adversarial samples, adversarial training has been shown to be e ective in defending against those which are powerful and easily cra ed. is is largely due to the fact that, in most adversarial training approaches [9, 20], adversarial samples ”
Attack Strength vs. Detectability Dilemma in Adversarial Machine Learning (2018, background): “Much of the research in defending deep learning models has gone into increasing the robustness of the model though either adversarial training [32]–[34] or defensive distillation [35], [36].”
Learning Adversary-Resistant Deep Neural Networks (2016, methodology): “Due to its computational efficiency, the fast gradient sign has been widely used in multiple studies [11], [13], [25].”
Using Non-invertible Data Transformations to Build Adversary-Resistant Deep Neural Networks (2016, methodology): “The same mechanism has also been employed for defending against adversarial samples, also known as adversarial training [24].”
Using Non-invertible Data Transformations to Build Adversarial-Robust Neural Networks (2016, methodology): “Recall that many previously proposed solutions, especially adversarial training methods [10], [24], can be classiﬁed as forms of data augmentation.”
Adversarial Examples for Malware Detection (2017, background): “There are many more variants of adversarial training [15,11,23], all slightly differing in their objectives from the original version introduced by Goodfellow et al.”
Learning Adversary-Resistant Deep Neural Networks (2016, unknown): “Technically speaking, adversarial training can be formally described as adding a regularization term known as DataGrad to a DNN’s training loss function [27]. regularization penalizes the directions uncovered by adversarial perturbations (introduced in Section 2.2).”
A Transdisciplinary Review of Deep Learning Research and Its Relevance for Water Resources Scientists (2017, background): “…can impressively evolve the age of persons on an image (Antipov et al., 2017), predict the next framework of videos (Mathieu et al., 2015), or produce superresolution images from coarse ones (Ledig et al., 2016); they have also helped to train deep networks (Ororbia et al., 2016) more robustly.”
Interpreting Adversarial Robustness: A View from Decision Surface in Input Space (2018, background): “Note this mixed partial derivative is different from Hessian (which is pure secondorder derivative of x or w), and thus is calculable (Ororbia et al. (2016)).”