Robust Neural Networks using Randomized Adversarial Training

Authors: Alexandre Araujo, Laurent Meunier, Rafael Pinot, Benjamin Negrevergne
Published: 2019-03-25 | Updated: 2020-02-13

Source: https://arxiv.org/abs/1903.10219

PDF: https://arxiv.org/pdf/1903.10219

AIにより推定されたラベル

敵対的学習 敵対的攻撃検出 モデルの頑健性保証

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

This paper tackles the problem of defending a neural network against adversarial attacks crafted with different norms (in particular ℓ_∞ and ℓ₂ bounded adversarial examples). It has been observed that defense mechanisms designed to protect against one type of attacks often offer poor performance against the other. We show that ℓ_∞ defense mechanisms cannot offer good protection against ℓ₂ attacks and vice-versa, and we provide both theoretical and empirical insights on this phenomenon. Then, we discuss various ways of combining existing defense mechanisms in order to train neural networks robust against both types of attacks. Our experiments show that these new defense mechanisms offer better protection when attacked with both norms.