This paper investigates the theory of robustness against adversarial attacks. It focuses on the family of randomization techniques that consist in injecting noise in the network at inference time. These techniques have proven effective in many contexts, but lack theoretical arguments. We close this gap by presenting a theoretical analysis of these approaches, hence explaining why they perform well in practice. More precisely, we provide the first result relating the randomization rate to robustness to adversarial attacks. This result applies for the general family of exponential distributions, and thus extends and unifies the previous approaches. We support our theoretical claims with a set of experiments.
This paper shows how adaptive systems can learn to add an optimal amount of noise to some nonlinear feedback systems. This "stochastic resonance" (SR) effect occurs in a wide range of physical and biological systems. The noise energy can enhance the faint periodic signals or faint broadband signals that force the dynamical systems. Fuzzy and other adaptive systems can learn to induce SR based only on samples from the process. The paper derives the SR optimality conditions that any stochastic learning system should try to achieve. The adaptive system learns the SR effect as the system performs a stochastic gradient ascent on the signal-to-noise ratio. The stochastic learning scheme does not depend on a fuzzy system or any other adaptive system. Simulations test this SR learning scheme on the popular quartic-bistable dynamical system and on other dynamical systems. The driving noise types range from Gaussian white noise to impulsive noise to chaotic noise.  In this paper, we explore and compare multiple solutions to the problem of data augmentation in image classification. Previous work has demonstrated the effectiveness of data augmentation through simple techniques, such as cropping, rotating, and flipping input images. We artificially constrain our access to data to a small subset of the ImageNet dataset, and compare each data augmentation technique in turn. One of the more successful data augmentations strategies is the traditional transformations mentioned above. We also experiment with GANs to generate images of different styles. Finally, we propose a method to allow a neural net to learn augmentations that best improve the classifier, which we call neural augmentation. We discuss the successes and shortcomings of this method on various datasets. Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative attacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56). The code is public available at this https URL. Neural networks are known to be vulnerable to adversarial examples. Carefully chosen perturbations to real images, while imperceptible to humans, induce misclassification and threaten the reliability of deep learning systems in the wild. To guard against adversarial examples, we take inspiration from game theory and cast the problem as a minimax zero-sum game between the adversary and the model. In general, for such games, the optimal strategy for both players requires a stochastic policy, also known as a mixed strategy. In this light, we propose Stochastic Activation Pruning (SAP), a mixed strategy for adversarial defense. SAP prunes a random subset of activations (preferentially pruning those with smaller magnitude) and scales up the survivors to compensate. We can apply SAP to pretrained networks, including adversarially trained models, without fine-tuning, providing robustness against adversarial examples. Experiments demonstrate that SAP confers robustness against attacks, increasing accuracy and preserving calibration. A novel instance of a stochastic resonance effect, under the form of a noise-improved performance, is shown to be possible for an optimal Bayesian estimator. Estimation of the frequency of a periodic signal corrupted by a phase noise is considered. The optimal Bayesian estimator, achieving the minimum of the mean square estimation error, is explicitly derived. Conditions are exhibited where this minimal error is reduced when the noise level is raised, over some ranges, where this occurs essentially with non-Gaussian noise, in the tested configurations. These results contribute a new step in the exploration of stochastic resonance and its potentialities for signal processing. This paper deals with stochastic resonance. This nonlinear physical phenomenon generally occurs in bistable systems excited by random input noise plus a sinusoid. Through its internal dynamics, such a system forces cooperation between the input noise and the input sine: provided the existence of fine tuning between the power noise and the dynamics, the system reacts periodically at the frequency of the sine. Of particular interest is the fact that the local output signal-to-noise ratio presents a maximum when plotted against the input noise power; the system resounds stochastically. Continuous-time systems have already been studied. We study the ability of intrinsically discrete-time systems [general nonlinear AR(1) models] to produce stochastic resonance. It is then suggested that such discrete systems can be used in signal processing.