Confidence-Calibrated Adversarial Training: Generalizing to Unseen Attacks

Authors: David Stutz, Matthias Hein, Bernt Schiele
Published: 2019-10-14 | Updated: 2020-06-30

Source: https://arxiv.org/abs/1910.06259

PDF: https://arxiv.org/pdf/1910.06259

Labels Predicted by AI

敵対的攻撃手法 ポイズニング 攻撃の評価

Please note that these labels were automatically added by AI. Therefore, they may not be entirely accurate.
For more details, please see the About the Literature Database page.

Abstract

Adversarial training yields robust models against a specific threat model, e.g., L_∞ adversarial examples. Typically robustness does not generalize to previously unseen threat models, e.g., other L_p norms, or larger perturbations. Our confidence-calibrated adversarial training (CCAT) tackles this problem by biasing the model towards low confidence predictions on adversarial examples. By allowing to reject examples with low confidence, robustness generalizes beyond the threat model employed during training. CCAT, trained only on L_∞ adversarial examples, increases robustness against larger L_∞, L₂, L₁ and L₀ attacks, adversarial frames, distal adversarial examples and corrupted examples and yields better clean accuracy compared to adversarial training. For thorough evaluation we developed novel white- and black-box attacks directly attacking CCAT by maximizing confidence. For each threat model, we use 7 attacks with up to 50 restarts and 5000 iterations and report worst-case robust test error, extended to our confidence-thresholded setting, across all attacks.