Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networks

By Thilo Strauss, Markus Hanselmann, Andrej Junginger, Holger Ulmer. 2017

149 citations recorded by the source corpus.

Deep learning has become the state of the art approach in many machine learning problems such as classification. It has recently been shown that deep learning is highly vulnerable to adversarial perturbations. Taking the camera systems of self-driving cars as an example, small adversarial perturbations can cause the system to make errors in important tasks, such as classifying traffic signs or detecting pedestrians. Hence, in order to use deep learning without safety concerns a proper defense strategy is required. We propose to use ensemble methods as a defense strategy against adversarial perturbations. We find that an attack leading one model to misclassify does not imply the same for other networks performing the same task. This makes ensemble methods an attractive defense strategy against adversarial attacks. We empirically show for the MNIST and the CIFAR-10 data sets that ensemble methods not only improve the accuracy of neural networks on test data but also increase their robustness against adversarial perturbations.

Subfields: Artificial Intelligence

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

Citations in the corpus

Towards Robust Neural Networks via Random Self-ensemble (2017, background): “It is known that ensemble of several trained models can improve the robustness [20], but will also increase the model size by k folds.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, background): “[89] studied ensemble of methods to defend a network against the perturbations.”
Disentangling Adversarial Robustness and Generalization (2018, methodology): “Defenses: Proposed defenses include detection and rejection methods [31, 25, 54, 60, 3, 63], pre-processing, quantization and dimensionality reduction methods [12, 73, 7], manifold-projection methods [39, 72, 82, 86], methods based on stochasticity/regularization or adapted architectures [109, 7, 68”
Strength in Numbers: Trading-off Robustness and Computation via Adversarially-Trained Ensembles (2018, background): “We add noise to the initial point so that the network can’t memorize the training dataset and mask or obfuscate the gradients at that point Uesato et al. (2018); Athalye et al.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, background): “Ensembling has received some attention (Pang et al., 2019; Strauss et al., 2017), but requires training multiple models.”
Data Augmentation Can Improve Robustness (2021, background): “Although mildly successful, we note that ensembling has received some attention in the context of adversarial training [38, 47].”
Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference (2020, background): “One related row of works are to exploit model ensemble (Tram`er et al., 2018; Strauss et al., 2017) in adversarial training.”
Improving DNN Robustness to Adversarial Attacks using Jacobian Regularization (2018, methodology): “…magnitudes; Parseval Networks [17] which constrain the Lip-schitz constant of each hidden layer in a DNN to be smaller than 1; the En-semble method [18], which takes the label that maximizes the average of the output probabilities of the classiﬁers in the ensemble as the predicted label; a Robust…”
Relating Adversarially Robust Generalization to Flat Minima (2021, methodology): “However, there are also many detection/rejection approaches [44, 38, 74, 79, 3, 83], socalled manifold-projection methods [55, 96, 109, 110], several methods based on pre-processing, quantization and/or dimensionality reduction [12, 98, 8], methods based on randomness, regularization or adapted arch”
Fixing Data Augmentation to Improve Adversarial Robustness (2021, background): “Although mildly successful, we note that ensembling has received some attention in the context of adversarial training (Pang et al., 2019; Strauss et al., 2017).”
The Pitfalls of Simplicity Bias in Neural Networks (2020, background): “Standard approaches to mitigate this issue—adversarial training [23, 42] and ensembles [69, 54, 37]—have had limited success on large-scale datasets.”
Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuning (2020, background): “Several works have demonstrated model ensembles [32, 34] to boost adversarial robustness, as the ensemble diversity can challenge the transferability of adversarial examples.”
Smooth Adversarial Training (2020, methodology): “…., 200 training epochs) to better cope with these training enhancements, adopt the early stopping strategy to prevent the catastrophic overﬁtting issue in robustness [70], and save checkpoints using model weight averaging [28] to approximate the model ensembling for stronger robustness [43, 61].”