Since the discovery of adversarial examples in machine learning, researchers have designed several techniques to train neural networks that are robust against different types of attacks (most notably @math and @math based attacks). However, it has been observed that the defense mechanisms designed to protect against one type of attack often offer poor performance against the other. In this paper, we introduce Randomized Adversarial Training (RAT), a technique that is efficient both against @math and @math attacks. To obtain this result, we build upon adversarial training, a technique that is efficient against @math attacks, and demonstrate that adding random noise at training and inference time further improves performance against attacks. We then show that RAT is as efficient as adversarial training against @math attacks while being robust against strong @math attacks. Our final comparative experiments demonstrate that RAT outperforms all state-of-the-art approaches against @math and @math attacks.
The FGSM attack can be seen as a one-step gradient method and have proposed variants of FGSM that perform multiple gradient descent steps. More specifically, introduced Projected Gradient Descent (PGD), an attack that can be used to generate adversarial examples defeating FGSM-based adversarial training. Naturally, also experimented adversarial training using adversarial examples generated with PGD. Adversarial training does offer an increased protection level against PGD adversarial examples, albeit at a higher computational cost. More recently, a number of defenses have been proposed @cite_0 @cite_17 @cite_6 and demonstrate good empirical results against some of the attacks, but do not offer a general improvement in robustness according to the thorough robustness study conducted by .
@cite_0 @cite_6 @cite_17
2962759300 2964224652
Adversarial perturbations of normal images are usually imperceptible to humans, but they can seriously confuse state-of-the-art machine learning models. What makes them so special in the eyes of image classifiers? In this paper, we show empirically that adversarial examples mainly lie in the low probability regions of the training distribution, regardless of attack types and targeted models. Using statistical hypothesis testing, we find that modern neural density models are surprisingly good at detecting imperceptible image perturbations. Based on this discovery, we devised PixelDefend, a new approach that purifies a maliciously perturbed image by moving it back towards the distribution seen in the training data. The purified image is then run through an unmodified classifier, making our method agnostic to both the classifier and the attacking method. As a result, PixelDefend can be used to protect already deployed models and be combined with other model-specific defenses. Experiments show that our method greatly improves resilience across a wide variety of state-of-the-art attacking methods, increasing accuracy on the strongest attack from 63 to 84 for Fashion MNIST and from 32 to 70 for CIFAR-10. Following recent work, neural networks are widely-known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification, threatening the reliability of deep learning in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, in such settings, optimal policies are stochastic. We propose stochastic activation pruning (SAP), an algorithm that prunes a random subset of activations, scaling up the survivors to compensate. The algorithm preferentially keeps activations with larger magnitudes. SAP can be applied to pre-trained neural networks, even adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that in the adversarial setting, SAP confers robustness, increasing accuracy and preserving calibration.