There were many attempts to explain the trade-off between accuracy and adversarial robustness. However,  there  was  no  clear  understanding  of  the  behaviors  of  a  robust  classifier  which  has human-like robustness.
 We  argue  (1)  why  we  need  to  consider  adversarial  robustness  against  varying  magnitudes  of perturbations not only focusing on a fixed perturbation threshold, (2) why we need to use different method to generate adversarially perturbed samples that can be used to train a robust classifier and measure the robustness of classifiers and (3) why we need to prioritize adversarial accuracies with different magnitudes.
 We introduce Lexicographical Genuine Robustness (LGR) of classifiers that combines the above requirements.   We also suggest a candidate oracle classifier called "Optimal Lexicographically Genuinely  Robust  Classifier  (OLGRC)"  that  prioritizes  accuracy  on  meaningful  adversarially perturbed  examples  generated  by  smaller  magnitude  perturbations.    The  training  algorithm  for estimating OLGRC requires lexicographical optimization unlike existing adversarial training methods. To apply lexicographical optimization to neural network, we utilize Gradient Episodic Memory (GEM) which was originally developed for continual learning by preventing catastrophic forgetting. Even though deep learning models have shown promising performances in image classification tasks [6] , most deep learning classifiers mis-classify imperceptibly perturbed images, i.e. adversarial examples [7] . This vulnerability can occur even when the adversarial attacks were applied before they print the images, and the printed images were read through a camera [8] . That result shows real-world threats of classifiers can exist. In addition, adversarial examples for a classifier can be transferable to other models [3] . This transferability of adversarial examples [9] enables attackers to exploit a target model with limited access to the target classifier. This kinds of attacks is called black-box attacks. In this work, we explained why existing adversarial training methods cannot train a classifier that has human-like robustness. We identified three properties of human-like classification: (1) human-like classification should be robust against varying magnitudes of adversarially perturbed samples and not just on a fixed maximum norm perturbations, (2) when we consider robustness on increasing magnitudes of adversarial perturbations, a human-like classifier should avoid considering already considered points multiple times, and (3) human-like classification need to prioritize the robustness against adversarially perturbed samples with smaller perturbation norm. The suggested properties explain why previous methods for adversarial training and evaluation can be incomplete. For example, the second property explains why commonly used evaluation of adversarial robustness may not fully reveal our intuitive understanding of human-like robustness as standard adversarial accuracies don't avoid pseudo adversarial examples. We defined a candidate oracle classifier called Optimal Lexicographically Genuinely Robust Classifier (OL-GRC). OLGRC is (almost everywhere) uniquely determined when dataset and norm were given. In order to train a OLGRC, we suggested a method to generate adversarially perturbed samples using a discriminator. We proposed to use Gradient Episodic Memory (GEM) [4] for lexicographical optimization [2] and an approach to applying GEM when simultaneously reducing multiple losses with lexicographical preferences. From the first experiment on the toy example from section 2, we showed that lexicographical optimization enables stable training even when other adversarial training methods failed to do so. The second experiment on the same toy example showed that we can use discriminator to roughly generate adversarially perturbed samples by avoiding already explored regions. Because of that, we could train a classifier that is similar to the theoretical OLGRC. From the experiment on the MNIST data, we showed that our methods (OLSRC and OLGRC) achieved better performances on natural accuracy and adversarial accuracy than using standard adversarial training method [3] .
We try to design and train a classifier whose adversarial robustness is more resemblance to robustness of human.
{"src": "scitldr-AIC_train", "paper_id": "BJeGFs9FsH"}