Learning with a Strong Adversary

By Ruitong Huang, Bing Xu, Dale Schuurmans, Csaba Szepesvari. 2015

376 citations recorded by the source corpus.

The robustness of neural networks to intended perturbations has recently attracted significant attention. In this paper, we propose a new method, \emph{learning with a strong adversary}, that learns robust classifiers from supervised data. The proposed method takes finding adversarial examples as an intermediate step. A new and simple way of finding adversarial examples is presented and experimentally shown to be efficient. Experimental results demonstrate that resulting learning method greatly improves the robustness of the classification models produced.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Towards the Science of Security and Privacy in Machine Learning (2016, background): “Follow-up work reduced the size of a perturbation r according to different metrics [53], [66].”
Towards Deep Learning Models Resistant to Adversarial Attacks (2017, background): “Indeed, this is the conclusion reached by prior work which then resorted to linearizing the inner maximization problem (Huang et al., 2015; Shaham et al., 2015).”
Deep Variational Information Bottleneck (2017, background): “…a minimal perturbation that changes the model’s classiﬁcation; single-step gradient-based attacks (Goodfellow et al., 2015; Kurakin et al., 2017; Huang et al., 2015), which choose a gradient direction of the image pixels at some loss and then take a single step in that direction; and iterative…”
Adversarial Machine Learning at Scale (2016, methodology): “It has been shown (Goodfellow et al., 2014; Huang et al., 2015) that injecting adversarial examples into the training set (also called adversarial training) could increase robustness of neural networks to adversarial examples.”
Model-Reuse Attacks on Deep Learning Systems (2018, background): “Another line of work attempts to improve DNN resilience against such attacks by developing new training and inference strategies [25, 29, 31, 45].”
AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation (2018, background): “, [3], [12], [14], [15], [17], [18], [29], [30], [32], [38], [41]).”
Towards Robust Neural Networks via Random Self-ensemble (2017, methodology): “Another popular defense approach is adversarial training [12, 11].”
Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods (2017, background): “There has been a significant amount of work studying methods to construct adversarial examples [5, 8, 13, 26, 30, 39] and to make networks robust against adversarial examples [3, 16, 20, 21, 31, 33, 34, 41].”
Adversarial Examples for Generative Models (2017, methodology): “They can also be approximated with single-step gradient-based techniques like fast gradient sign [3], fast gradient L 2 [17], or fast least likely class [12]; or they can be approximated with iterative variants of those and other gradient-based techniques [12], [13].”
Adversarial Examples Detection in Deep Networks with Convolutional Filter Statistics (2016, methodology): “[25, 8] propose approaches to sample adversaries or minimax optimization for making learning more robust.”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, background): “[122] showed that adversarial training improved the robustness of DNNs.”
Universal Adversarial Perturbations (2016, methodology): “…each datapoint x i ∈ X do 6: Compute the minimal perturbation that sends x i + v to the decision boundary: Update the perturbation: end for 11: end while standard classiﬁer (e.g., a deep neural network), several ef-ﬁcient approximate methods have been devised for solving this problem [19, 11, 7].”
Evolving Robust Neural Architectures to Defend from Adversarial Attacks (2019, neutral): “The addition of adversarial samples to the training dataset, called adversarial training, was also proposed [Goodfellow et al., 2014; Huang et al., 2015; Madry et al., 2018].”
Robust Convolutional Neural Networks under Adversarial Noise (2015, background): “While Bishop (1995) showed that training with noise is equivalent to a regularizer, Goodfellow et al. (2014); Huang et al. (2015) used adversarial perturbation during training but not has been applied to natural images or more challenging image classiﬁcation tasks.”
Measuring Neural Net Robustness with Constraints (2016, background): “In Figure 1 note that the direction of the nearest adversarial example is not necessary aligned with the signed gradient of the loss function, as observed by others [7].”
Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation (2017, methodology): “Subsequent research has found fast ways to generate adversarial samples with high probability [7, 12, 19] and suggested to use them during training as a form of data augmentation to gain more robustness.”
One Pixel Attack for Fooling Deep Neural Networks (2017, background): “Adversarial training [40] is proposed for adding adversarial images to the training data such that the robustness against known adversarial images can be improved.”