Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
Not on the map. Why?
Abstract (arXiv)
Recent improvements in deep learning models and their practical applications have raised concerns about the robustness of these models against adversarial examples. Adversarial training (AT) has been shown effective to reach a robust model against the attack that is used during training. However, it usually fails against other attacks, i.e. the model overfits to the training attack scheme. In this paper, we propose a simple modification to the AT that mitigates the mentioned issue. More specifically, we minimize the perturbation ℓp norm while maximizing the classification loss in the Lagrangian form. We argue that crafting adversarial examples based on this scheme results in enhanced attack generalization in the learned model. We compare our final model robust accuracy against attacks that were not used during training to closely related state-of-the-art AT methods. This comparison demonstrates that our average robust accuracy against unseen attacks is 5.9% higher in the CIFAR-10 dataset and is 3.2% higher in the ImageNet-100 dataset than corresponding state-of-the-art methods. We also demonstrate that our attack is faster than other attack schemes that are designed for unseen attack generalization, and conclude that it is feasible for large-scale datasets.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 48 of its 70 references that are in the map. First posted on arXiv 29 Mar 2021.
Builds on
48 of 70 references.
References · 48
- 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016Adversarial examples in the physical worldcited by 1,769
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
36 more
- 2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,077
- 2020In Search of Lost Domain Generalizationcited by 1,054
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
- 2018Robustness May Be at Odds with Accuracycited by 880
- 2020Overfitting in adversarially robust deep learningcited by 506
- 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 460
- 2020Measuring Robustness to Natural Distribution Shifts in Image Classificationcited by 454
- 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
- 2018Deep Face Recognition: A Surveycited by 276
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2020Understanding and Improving Fast Adversarial Trainingcited by 214
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
- 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 172
- 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 153
- 2020Adversarial Self-Supervised Contrastive Learningcited by 139
- 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
- 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
- 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
- 2020Feature Purification: How Adversarial Training Performs Robust Deep Learningcited by 107
- 2019Sparse and Imperceivable Adversarial Attackscited by 95
- 2018SparseFool: a few pixels make a big differencecited by 94
- 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
- 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
- 2019Functional Adversarial Attackscited by 82
- 2020Precise Tradeoffs in Adversarial Training for Linear Regressioncited by 77
- 2021On the effectiveness of adversarial training against common corruptionscited by 71
- 2019Instance adaptive adversarial training: Improved accuracy tradeoffs in neural netscited by 55
- 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
- 2019E-LPIPS: Robust Perceptual Image Similarity via Random Transformation Ensemblescited by 45
- 2017Synthesizing Robust Adversarial Examplescited by 39
- 2020Augmented Lagrangian Adversarial Attackscited by 28
- 2020Adversarially Robust Estimate and Risk Analysis in Linear Regressioncited by 22
- 2019On the Sensitivity of Adversarial Robustness to Input Data Distributionscited by 20
- 2019Should Adversarial Attacks Use Pixel p-Norm?cited by 10
Built on by
Citing papers per year: 2022: 2; 2023: 1.
3 papers.