Resilience from Diversity: Population-based approach to harden models against adversarial attacks
Not on the map. Why?
Abstract (arXiv)
Traditional deep learning networks (DNN) exhibit intriguing vulnerabilities that allow an attacker to force them to fail at their task. Notorious attacks such as the Fast Gradient Sign Method (FGSM) and the more powerful Projected Gradient Descent (PGD) generate adversarial samples by adding a magnitude of perturbation ε to the input's computed gradient, resulting in a deterioration of the effectiveness of the model's classification. This work introduces a model that is resilient to adversarial attacks. Our model leverages an established mechanism of defense which utilizes randomness and a population of DNNs. More precisely, our model consists of a population of n diverse submodels, each one of them trained to individually obtain a high accuracy for the task at hand, while forced to maintain meaningful differences in their weights. Each time our model receives a classification query, it selects a submodel from its population at random to answer the query. To counter the attack transferability, diversity is introduced and maintained in the population of submodels. Thus introducing the concept of counter linking weights. A Counter-Linked Model (CLM) consists of a population of DNNs of the same architecture where a periodic random similarity examination is conducted during the simultaneous training to guarantee diversity while maintaining accuracy. Though the randomization technique proved to be resilient against adversarial attacks, we show that by retraining the DNNs ensemble or training them from the start with counter linking would enhance the robustness by around 20% when tested on the MNIST dataset and at least 15% when tested on the CIFAR-10 dataset. When CLM is coupled with adversarial training, this defense mechanism achieves state-of-the-art robustness.
Key facts. Cited by 1 paper in the map (data through 13 Oct 2026). Builds on 33 of its 39 references that are in the map. First posted on arXiv 19 Nov 2021.
Builds on
33 of 39 references.
References · 33
- 2015Deep Residual Learning for Image Recognitioncited by 51,950
- 2014Explaining and Harnessing Adversarial Examplescited by 7,336
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
- 2013Intriguing properties of neural networkscited by 5,137
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,445
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 839
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 566
- 2017Countering Adversarial Images using Input Transformationscited by 519
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 467
- 2017Mitigating Adversarial Effects Through Randomizationcited by 382
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
21 more
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
- 2018Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learningcited by 204
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
- 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 182
- 2018Certified Adversarial Robustness with Additive Noisecited by 179
- 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
- 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
- 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
- 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 157
- 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 153
- 2018Sparse DNNs with Improved Adversarial Robustnesscited by 72
- 2018Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Networkcited by 69
- 2018Training for Faster Adversarial Robustness Verification via Inducing ReLU Stabilitycited by 67
- 2018On the Robustness of the CVPR 2018 White-Box Adversarial Example Defensescited by 40
- 2017Analyzing the Robustness of Nearest Neighbors to Adversarial Examplescited by 36
- 2017Ensemble Methods as a Defense to Adversarial Perturbations Against Deep Neural Networkscited by 31
- 2019Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defensescited by 8
- 2017Feature Squeezing Mitigates and Detects Carlini/Wagner Adversarial Examplescited by 3
- 2018Breaking Transferability of Adversarial Samples with Randomnesscited by 2
- 2020AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attackscited by 1
Built on by
Citing papers per year: 2022: 1.
1 paper.